Reed–Solomon codes are a group of errorcorrecting codes that were introduced by Irving S. Reed and Gustave Solomon in 1960. They have many applications, the most prominent of which include consumer technologies such as CDs, , , , data transmission technologies such as DSL and WiMAX, Broadcasting systems such as satellite communications, DVB and ATSC Standards, and storage systems such as RAID 6.
Reed–Solomon codes operate on a block of data treated as a set of finite field elements called symbols. For example, a block of 4096 bytes (32,768 bits) could be treated as a set of 2731 12bit symbols, where each symbol is a finite field element of GF(2^{12}), the last symbol padded with four 0 bits. Reed–Solomon codes are able to detect and correct multiple symbol errors. By adding check symbols to the data, a Reed–Solomon code can detect any combination of up to and including erroneous symbols, or correct up to and including symbols. As an erasure code, it can correct up to and including known erasures, or it can detect and correct combinations of errors and erasures. Reed–Solomon codes are also suitable as multipleburst error biterror correcting codes, since a sequence of consecutive bit errors can affect at most two symbols of size . The choice of is up to the designer of the code, and may be selected within wide limits.
There are two basic types of Reed–Solomon codes, and , with BCH view being the most common as BCH view decoders are faster and require less working storage than original view decoders.
Also in 1960, a practical fixed polynomial decoder for BCH codes codes developed by Daniel Gorenstein and Neal Zierler was described in an MIT Lincoln Laboratory report by Zierler in January 1960 and later in a paper in June 1961.D. Gorenstein and N. Zierler, "A class of cyclic linear errorcorrecting codes in p^m symbols", J. SIAM, vol. 9, pp. 207214, June 1961 The GorensteinZierler decoder and the related work on BCH codes are described in a book Error Correcting Codes by W. Wesley Peterson (1961).Error Correcting Codes by W_Wesley_Peterson, 1961 By 1963 (or possibly earlier), J. J. Stone (and others) recognized that Reed Solomon codes could use the BCH scheme of using a fixed generator polynomial, making such codes a special class of BCH codes,Error Correcting Codes by W_Wesley_Peterson, second edition, 1972, but Reed Solomon codes based on the original encoding scheme, are not a class of BCH codes, and depending on the set of evaluation points, they are not even cyclic code.
In 1969, an improved BCH scheme decoder was developed by Elwyn Berlekamp and James Massey, and is since known as the Berlekamp–Massey decoding algorithm.
In 1975, another improved BCH scheme decoder was developed by Yasuo Sugiyama, based on the extended Euclidean algorithm.Yasuo Sugiyama, Masao Kasahara, Shigeichi Hirasawa, and Toshihiko Namekawa. A method for solving key equation for decoding Goppa codes. Information and Control, 27:87–99, 1975.
In 1977, Reed–Solomon codes were implemented in the Voyager program in the form of concatenated error correction codes. The first commercial application in massproduced consumer products appeared in 1982 with the compact disc, where two interleaved Reed–Solomon codes are used. Today, Reed–Solomon codes are widely implemented in digital storage devices and digital communication standards, though they are being slowly replaced by more modern lowdensity paritycheck (LDPC) codes or . For example, Reed–Solomon codes are used in the Digital Video Broadcasting (DVB) standard DVBS, but LDPC codes are used in its successor, DVBS2.
In 1986, an original scheme decoder known as the Berlekamp–Welch algorithm was developed.
In 1996, variations of original scheme decoders called list decoders or soft decoders were developed by Madhu Sudan and others, and work continues on these type of decoders – see Guruswami–Sudan list decoding algorithm.
In 2002, another original scheme decoder was developed by Shuhong Gao, based on the Extended Euclidean algorithm Gao_RS.pdf .
Reed–Solomon coding is a key component of the compact disc. It was the first use of strong error correction coding in a massproduced consumer product, and DAT and DVD use similar schemes. In the CD, two layers of Reed–Solomon coding separated by a 28way interleaver yields a scheme called CrossInterleaved Reed–Solomon Coding (CIRC). The first element of a CIRC decoder is a relatively weak inner (32,28) Reed–Solomon code, shortened from a (255,251) code with 8bit symbols. This code can correct up to 2 byte errors per 32byte block. More importantly, it flags as erasures any uncorrectable blocks, i.e., blocks with more than 2 byte errors. The decoded 28byte blocks, with erasure indications, are then spread by the deinterleaver to different blocks of the (28,24) outer code. Thanks to the deinterleaving, an erased 28byte block from the inner code becomes a single erased byte in each of 28 outer code blocks. The outer code easily corrects this, since it can handle up to 4 such erasures per block.
The result is a CIRC that can completely correct error bursts up to 4000 bits, or about 2.5 mm on the disc surface. This code is so strong that most CD playback errors are almost certainly caused by tracking errors that cause the laser to jump track, not by uncorrectable error bursts.
DVDs use a similar scheme, but with much larger blocks, a (208,192) inner code, and a (182,172) outer code.
Reed–Solomon error correction is also used in parchive files which are commonly posted accompanying multimedia files on USENET. The Distributed online storage service Wuala (discontinued in 2015) also used to make use of Reed–Solomon when breaking up files.
Reed–Solomon coding is less common in onedimensional bar codes, but is used by the PostBar symbology.
Any combination of K codewords received at the other end is enough to reconstruct all of the N codewords. The code rate is generally set to 1/2 unless the channel's erasure likelihood can be adequately modelled and is seen to be less. In conclusion, N is usually 2 K, meaning that at least half of all the codewords sent must be received in order to reconstruct all of the codewords sent.
Reed–Solomon codes are also used in xDSL systems and CCSDS's Space Communications Protocol Specifications as a form of forward error correction.
Voyager introduced Reed–Solomon coding concatenated with convolutional codes, a practice that has since become very widespread in deep space and satellite (e.g., direct digital broadcasting) communications.
tend to produce errors in short bursts. Correcting these burst errors is a job best done by short or simplified Reed–Solomon codes.
Modern versions of concatenated Reed–Solomon/Viterbidecoded convolutional coding were and are used on the Mars Pathfinder, Galileo probe, Mars Exploration Rover and Cassini probe missions, where they perform within about 1–1.5 decibel of the ultimate limit, being the Shannon capacity.
These concatenated codes are now being replaced by more powerful .
Formally, the set $\backslash mathbf\{C\}$ of codewords of the Reed–Solomon code is defined as follows:
= \Big\{\; \big( p(a_1), p(a_2), \dots, p(a_n) \big) \;\Big\; p \text{ is a polynomial over } F \text{ of degree }Since any two distinct polynomials of degree less than $k$ agree in at most $k1$ points, this means that any two codewords of the Reed–Solomon code disagree in at least $n\; \; (k1)\; =\; nk+1$ positions. Furthermore, there are two polynomials that do agree in $k2$ points but are not equal, and thus, the distance of the Reed–Solomon code is exactly $d=nk+1$. Then the relative distance is $\backslash delta\; =\; d/n\; =\; 1k/n\; +\; 1/n\; =\; 1R+1/n\backslash sim\; 1R$, where $R=k/n$ is the rate. This tradeoff between the relative distance and the rate is asymptotically optimal since, by the Singleton bound, every code satisfies $\backslash delta+R\backslash leq\; 1+1/n$. Being a code that achieves this optimal tradeoff, the Reed–Solomon code belongs to the class of maximum distance separable codes. While the number of different polynomials of degree less than k and the number of different messages are both equal to $q^k$, and thus every message can be uniquely mapped to such a polynomial, there are different ways of doing this encoding. The original construction of interprets the message x as the coefficients of the polynomial p, whereas subsequent constructions interpret the message as the values of the polynomial at the first k points $a\_1,\backslash dots,a\_k$ and obtain the polynomial p by interpolating these values with a polynomial of degree less than k. The latter encoding procedure, while being slightly less efficient, has the advantage that it gives rise to a systematic code, that is, the original message is always contained as a subsequence of the codeword.
Simple encoding procedure: The message as a sequence of coefficientsIn the original construction of , the message $x=(x\_1,\backslash dots,x\_k)\backslash in\; F^k$ is mapped to the polynomial $p\_x$ withThe codeword of $x$ is obtained by evaluating $p\_x$ at $n$ different points $a\_1,\backslash dots,a\_n$ of the field $F$. Thus the classical encoding function $C:F^k\; \backslash to\; F^n$ for the Reed–Solomon code is defined as follows:
 $p\_x(a)\; =\; \backslash sum\_\{i=1\}^k\; x\_i\; a^\{i1\}\; \backslash ,.$
This function $C$ is a linear mapping, that is, it satisfies $C(x)\; =\; x\; \backslash cdot\; A$ for the following $(k\backslash times\; n)$matrix $A$ with elements from $F$:
 $C(x)\; =\; \backslash big(p\_x(a\_1),\backslash dots,p\_x(a\_n)\backslash big)\backslash ,.$
1 & \dots & 1 & \dots & 1 \\ a_1 & \dots & a_k & \dots & a_n \\ a_1^2 & \dots & a_k^2 & \dots & a_n^2 \\ \vdots & \dots & \vdots & \dots & \vdots \\ a_1^{k1} & \dots & a_k^{k1} & \dots & a_n^{k1} \end{bmatrix}
 $A=\backslash begin\{bmatrix\}$
This matrix is the transpose of a Vandermonde matrix over $F$. In other words, the Reed–Solomon code is a linear code, and in the classical encoding procedure, its generator matrix is $A$.
Systematic encoding procedure: The message as an initial sequence of valuesThere is an alternative encoding procedure that also produces the Reed–Solomon code, but that does so in a systematic code way. Here, the mapping from the message $x$ to the polynomial $p\_x$ works differently: the polynomial $p\_x$ is now defined as the unique polynomial of degree less than $k$ such thatTo compute this polynomial $p\_x$ from $x$, one can use Lagrange interpolation. Once it has been found, it is evaluated at the other points $a\_\{k+1\},\backslash dots,a\_n$ of the field. The alternative encoding function $C:F^k\; \backslash to\; F^n$ for the Reed–Solomon code is then again just the sequence of values:
 $p\_x(a\_i)\; =\; x\_i$ holds for all $i\backslash in\backslash \{1,\backslash dots,k\backslash \}$.
Since the first $k$ entries of each codeword $C(x)$ coincide with $x$, this encoding procedure is indeed systematic code. Since Lagrange interpolation is a linear transformation, $C$ is a linear mapping. In fact, we have $C(x)\; =\; x\; \backslash cdot\; G$, where
 $C(x)\; =\; \backslash big(p\_x(a\_1),\backslash dots,p\_x(a\_n)\backslash big)\backslash ,.$
(A\text{'s left square submatrix})^{1}\cdot A = \begin{bmatrix} 1 & 0 & 0 & \dots & 0 & g_{1,k+1} & \dots & g_{1,n} \\ 0 & 1 & 0 & \dots & 0 & g_{2,k+1} & \dots & g_{2,n} \\ 0 & 0 & 1 & \dots & 0 & g_{3,k+1} & \dots & g_{3,n} \\ \vdots & \vdots & \vdots & \vdots & \vdots & \vdots & \vdots & \vdots \\ 0 & \dots & 0 & \dots & 1 & g_{k,k+1} & \dots & g_{k,n} \end{bmatrix}
 $G=$
Discrete Fourier transform and its inverseA discrete Fourier transform is essentially the same as the encoding procedure; it uses the generator polynomial p(x) to map a set of evaluation points into the message values as shown above:
 $C(x)\; =\; \backslash big(p\_x(a\_1),\backslash dots,p\_x(a\_n)\backslash big)\backslash ,.$
The inverse Fourier transform could be used to convert an error free set of n < q message values back into the encoding polynomial of k coefficients, with the constraint that in order for this to work, the set of evaluation points used to encode the message must be a set of increasing powers of α:
 $a\_i\; =\; \backslash alpha^\{i1\}$
 $a\_1,\; \backslash dots,\; a\_n\; =\; \backslash \{\; 1,\; \backslash alpha,\; \backslash alpha^2,\; \backslash dots,\; \backslash alpha^\{n1\}\; \backslash \}$
However, Lagrange interpolation performs the same conversion without the constraint on the set of evaluation points or the requirement of an error free set of message values and is used for systematic encoding, and in one of the steps of the Gao decoder.
The BCH view: The codeword as a sequence of coefficientsIn this view, the sender again maps the message $x$ to a polynomial $p\_x$, and for this, any of the two mappings just described can be used (where the message is either interpreted as the coefficients of $p\_x$ or as the initial sequence of values of $p\_x$). Once the sender has constructed the polynomial $p\_x$ in some way, however, instead of sending the values of $p\_x$ at all points, the sender computes some related polynomial $s$ of degree at most $n1$ for $n=q1$ and sends the $n$ coefficients of that polynomial. The polynomial $s(a)$ is constructed by multiplying the message polynomial $p\_x(a)$, which has degree at most $k1$, with a generator polynomial $g(a)$ of degree $nk$ that is known to both the sender and the receiver. The generator polynomial $g(x)$ is defined as the polynomial whose roots are exactly $\backslash alpha,\backslash alpha^2,\backslash dots,\backslash alpha^\{nk\}$, i.e.,
 $g(x)\; =\; (x\backslash alpha)(x\backslash alpha^2)\backslash cdots(x\backslash alpha^\{nk\})\; =\; g\_0\; +\; g\_1x\; +\; \backslash cdots\; +\; g\_\{nk1\}x^\{nk1\}\; +\; x^\{nk\}\backslash ,.$
The transmitter sends the $n=q1$ coefficients of $s(a)=p\_x(a)\; \backslash cdot\; g(a)$. Thus, in the BCH view of Reed–Solomon codes, the set $\backslash mathbf\{C\}$ of codewords is defined for $n=q1$ as follows:
\left\{
 $\backslash mathbf\{C\}\; =$
\left ( s_1, s_2,\dots, s_{n} \right) \;\Big\; s(a)=\sum_{i=1}^n s_i a^{i1} \text{ is a polynomial that has at least the roots } \alpha^1,\alpha^2, \dots, \alpha^{nk}\right\}\,.
Systematic encoding procedureThe encoding procedure for the BCH view of Reed–Solomon codes can be modified to yield a systematic code, in which each codeword contains the message as a prefix. Here, instead of sending $s(x)\; =\; p(x)\; g(x)$, the encoder constructs the transmitted polynomial $s(x)$ such that the coefficients of the $k$ largest monomials are equal to the corresponding coefficients of $p(x)$, and the lowerorder coefficients of $s(x)$ are chosen exactly in such a way that $s(x)$ becomes divisible by $g(x)$. Then the coefficients of $p(x)$ are a subsequence (specifically, a prefix) of the coefficients of $s(x)$. To get a code that is overall systematic, we construct the message polynomial $p(x)$ by interpreting the message as the sequence of its coefficients.Formally, the construction is done by multiplying $p(x)$ by $x^t$ to make room for the $t=nk$ check symbols, dividing that product by $g(x)$ to find the remainder, and then compensating for that remainder by subtracting it. The $t$ check symbols are created by computing the remainder $s\_r(x)$:
 $s\_r(x)\; =\; p(x)\backslash cdot\; x^t\; \backslash \; \backslash bmod\; \backslash \; g(x).$
Note that the remainder has degree at most $t1$, whereas the coefficients of $x^\{t1\},x^\{t2\},\backslash dots,x^1,x^0$ in the polynomial $p(x)\backslash cdot\; x^t$ are zero. Therefore, the following definition of the codeword $s(x)$ has the property that the first $k$ coefficients are identical to the coefficients of $p(x)$:
 $s(x)\; =\; p(x)\backslash cdot\; x^t\; \; s\_r(x)\backslash ,.$
As a result, the codewords $s(x)$ are indeed elements of $\backslash mathbf\{C\}$, that is, they are divisible by the generator polynomial $g(x)$:See , for example.
 $s(x)\; \backslash equiv\; p(x)\backslash cdot\; x^t\; \; s\_r(x)\; \backslash equiv\; s\_r(x)\; \; s\_r(x)\; \backslash equiv\; 0\; \backslash mod\; g(x)\backslash ,.$
PropertiesThe Reed–Solomon code is a n, code; in other words, it is a linear code of length n (over F) with dimension k and minimum Hamming distance n − k + 1. The Reed–Solomon code is optimal in the sense that the minimum distance has the maximum value possible for a linear code of size ( n, k); this is known as the Singleton bound. Such a code is also called a MDS code.The errorcorrecting ability of a Reed–Solomon code is determined by its minimum distance, or equivalently, by $n\; \; k$, the measure of redundancy in the block. If the locations of the error symbols are not known in advance, then a Reed–Solomon code can correct up to $(nk)/2$ erroneous symbols, i.e., it can correct half as many errors as there are redundant symbols added to the block. Sometimes error locations are known in advance (e.g., "side information" in demodulator signaltonoise ratios)—these are called erasures. A Reed–Solomon code (like any MDS code) is able to correct twice as many erasures as errors, and any combination of errors and erasures can be corrected as long as the relation 2 E + S ≤ n − k is satisfied, where $E$ is the number of errors and $S$ is the number of erasures in the block.
For practical uses of Reed–Solomon codes, it is common to use a finite field $F$ with $2^m$ elements. In this case, each symbol can be represented as an $m$bit value. The sender sends the data points as encoded blocks, and the number of symbols in the encoded block is $n\; =\; 2^m\; \; 1$. Thus a Reed–Solomon code operating on 8bit symbols has $n\; =\; 2^8\; \; 1\; =\; 255$ symbols per block. (This is a very popular value because of the prevalence of byteoriented computer systems.) The number $k$, with $k\; <\; n$, of data symbols in the block is a design parameter. A commonly used code encodes $k\; =\; 223$ eightbit data symbols plus 32 eightbit parity symbols in an $n\; =\; 255$symbol block; this is denoted as a $(n,\; k)\; =\; (255,223)$ code, and is capable of correcting up to 16 symbol errors per block.
The Reed–Solomon code properties discussed above make them especially wellsuited to applications where errors occur in burst error. This is because it does not matter to the code how many bits in a symbol are in error — if multiple bits in a symbol are corrupted it only counts as a single error. Conversely, if a data stream is not characterized by error bursts or dropouts but by random single bit errors, a Reed–Solomon code is usually a poor choice compared to a binary code.
The Reed–Solomon code, like the convolutional code, is a transparent code. This means that if the channel symbols have been bitwise NOT somewhere along the line, the decoders will still operate. The result will be the inversion of the original data. However, the Reed–Solomon code loses its transparency when the code is shortened. The "missing" bits in a shortened code need to be filled by either zeros or ones, depending on whether the data is complemented or not. (To put it another way, if the symbols are inverted, then the zerofill needs to be inverted to a onefill.) For this reason it is mandatory that the sense of the data (i.e., true or complemented) be resolved before Reed–Solomon decoding.
Whether the Reed–Solomon code is cyclic code or not depends on subtle details of the construction. In the original view of Reed and Solomon, where the codewords are the values of a polynomial, one can choose the sequence of evaluation points in such a way as to make the code cyclic. In particular, if $\backslash alpha$ is a primitive root of the field $F$, then by definition all nonzero elements of $F$ take the form $\backslash alpha^i$ for $i\backslash in\backslash \{1,\backslash dots,q1\backslash \}$, where $q=F$. Each polynomial $p$ over $F$ gives rise to a codeword $(p(\backslash alpha^1),\backslash dots,p(\backslash alpha^\{q1\}))$. Since the function $a\backslash mapsto\; p(\backslash alpha\; a)$ is also a polynomial of the same degree, this function gives rise to a codeword $(p(\backslash alpha^2),\backslash dots,p(\backslash alpha^\{q\}))$; since $\backslash alpha^\{q\}=\backslash alpha^1$ holds, this codeword is the circular shift of the original codeword derived from $p$. So choosing a sequence of primitive root powers as the evaluation points makes the original view Reed–Solomon code cyclic code. Reed–Solomon codes in the BCH view are always cyclic because BCH codes are cyclic.
RemarksDesigners are not required to use the "natural" sizes of Reed–Solomon code blocks. A technique known as "shortening" can produce a smaller code of any desired size from a larger code. For example, the widely used (255,223) code can be converted to a (160,128) code by padding the unused portion of the source block with 95 binary zeroes and not transmitting them. At the decoder, the same portion of the block is loaded locally with binary zeroes. The DelsarteGoethalsSeidel. Explains the DelsarteGoethalsSeidel theorem as used in the context of the error correcting code for compact disc. theorem illustrates an example of an application of shortened Reed–Solomon codes. In parallel to shortening, a technique known as puncturing allows omitting some of the encoded parity symbols.
Reed Solomon original view decodersThe decoders described in this section use the Reed Solomon original view of a codeword as a sequence of polynomial values where the polynomial is based on the message to be encoded. The same set of fixed values are used by the encoder and decoder, and the decoder recovers the encoding polynomial (and optionally an error locating polynomial) from the received message.
Theoretical decoderdescribed a theoretical decoder that corrected errors by finding the most popular message polynomial. The decoder only knows the set of values $a\_1$ to $a\_n$ and which encoding method was used to generate the codeword's sequence of values. The original message, the polynomial, and any errors are unknown. A decoding procedure could use a method like Lagrange interpolation on various subsets of n codeword values taken k at a time to repeatedly produce potential polynomials, until a sufficient number of matching polynomials are produced to reasonably eliminate any errors in the received codeword. Once a polynomial is determined, then any errors in the codeword can be corrected, by recalculating the corresponding codeword values. Unfortunately, in all but the simplest of cases, there are too many subsets, so the algorithm is impractical. The number of subsets is the binomial coefficient, $\backslash textstyle\; \backslash binom\{n\}\{k\}\; =\; \{n!\; \backslash over\; (nk)!\; k!\}$, and the number of subsets is infeasible for even modest codes. For a $(255,249)$ code that can correct 3 errors, the naive theoretical decoder would examine 359 billion subsets.
Berlekamp Welch decoderIn 1986, a decoder known as the Berlekamp–Welch algorithm was developed as a decoder that is able to recover the original message polynomial as well as an error "locator" polynomial that produces zeroes for the input values that correspond to errors, with time complexity O(n^3), where n is the number of values in a message. The recovered polynomial is then used to recover (recalculate as needed) the original message.
ExampleUsing RS(7,3), GF(929), and the set of evaluation points a_{i} = i1
If the message polynomial is
The codeword is
Errors in transmission might cause this to be received instead.
The key equations are:
 $b\_i\; E(a\_i)\; \; Q(a\_i)\; =\; 0$
Assume maximum number of errors: e = 2. The key equations become:
 $b\_i(e\_0\; +\; e\_1\; a\_i)\; \; (q\_0\; +\; q\_1\; a\_i\; +\; q\_2\; a\_i^2\; +\; q\_3\; a\_i^3\; +\; q\_4\; a\_i^4)\; =\; \; b\_i\; a\_i^2$
001 & 000 & 928 & 000 & 000 & 000 & 000 \\ 006 & 006 & 928 & 928 & 928 & 928 & 928 \\ 123 & 246 & 928 & 927 & 925 & 921 & 913 \\ 456 & 439 & 928 & 926 & 920 & 902 & 848 \\ 057 & 228 & 928 & 925 & 913 & 865 & 673 \\ 086 & 430 & 928 & 924 & 904 & 804 & 304 \\ 121 & 726 & 928 & 923 & 893 & 713 & 562 \end{bmatrix} \begin{bmatrix} e_0 \\ e_1 \\ q_0 \\ q_1 \\ q_2 \\ q_3 \\ q_4 \end{bmatrix} = \begin{bmatrix} 000 \\ 923 \\ 437 \\ 541 \\ 017 \\ 637 \\ 289 \end{bmatrix}
 $\backslash begin\{bmatrix\}$
Using Gaussian elimination:
\begin{bmatrix} 001 & 000 & 000 & 000 & 000 & 000 & 000 \\ 000 & 001 & 000 & 000 & 000 & 000 & 000 \\ 000 & 000 & 001 & 000 & 000 & 000 & 000 \\ 000 & 000 & 000 & 001 & 000 & 000 & 000 \\ 000 & 000 & 000 & 000 & 001 & 000 & 000 \\ 000 & 000 & 000 & 000 & 000 & 001 & 000 \\ 000 & 000 & 000 & 000 & 000 & 000 & 001 \end{bmatrix} \begin{bmatrix} e_0 \\ e_1 \\ q_0 \\ q_1 \\ q_2 \\ q_3 \\ q_4 \end{bmatrix} = \begin{bmatrix} 006 \\ 924 \\ 006 \\ 007 \\ 009 \\ 916 \\ 003 \end{bmatrix}
 $$
Recalculate where to correct resulting in the corrected codeword:
Gao decoderIn 2002, an improved decoder was developed by Shuhong Gao, based on the extended Euclid algorithm Gao_RS.pdf .
ExampleUsing the same data as the Berlekamp Welch example above:
 $R\_\{1\}\; =\; \backslash prod\_\{i=1\}^n\; (x\; \; a\_i)$
 $R\_0\; =$ Lagrange interpolation of $\backslash \{a\_i,\; b(a\_i)\backslash \}$ for i = 1 to n
 $A\_\{1\}\; =\; 0$
 $A\_0\; =\; 1$
−1 001 x^{7} + 908 x^{6} + 175 x^{5} + 194 x^{4} + 695 x^{3} + 094 x^{2} + 720 x + 000 000 0 055 x^{6} + 440 x^{5} + 497 x^{4} + 904 x^{3} + 424 x^{2} + 472 x + 001 001 1 702 x^{5} + 845 x^{4} + 691 x^{3} + 461 x^{2} + 327 x + 237 152 x + 237 2 266 x^{4} + 086 x^{3} + 798 x^{2} + 311 x + 532 708 x^{2} + 176 x + 532
divide Q(x) and E(x) by most significant coeficient of E(x) = 708. (Optional)
Recalculate where to correct resulting in the corrected codeword:
BCH view decodersThe decoders described in this section use the BCH view of a codeword as a sequence of coefficients. They use a fixed generator polynomial known to both encoder and decoder.
Peterson–Gorenstein–Zierler decoderDaniel Gorenstein and Neal Zierler developed a decoder that was described in a MIT Lincoln Laboratory report by Zierler in January 1960 and later in a paper in June 1961.D. Gorenstein and N. Zierler, "A class of cyclic linear errorcorrecting codes in p^m symbols," J. SIAM, vol. 9, pp. 207214, June 1961 The GorensteinZierler decoder and the related work on BCH codes are described in a book Error Correcting Codes by W. Wesley Peterson (1961).Error Correcting Codes by W_Wesley_Peterson, 1961
Syndrome decodingThe transmitted message is viewed as the coefficients of a polynomial s( x) that is divisible by a generator polynomial g( x).
 $s(x)\; =\; \backslash sum\_\{i\; =\; 0\}^\{n1\}\; c\_i\; x^i$
 $g(x)\; =\; \backslash prod\_\{j=1\}^\{nk\}\; (x\; \; \backslash alpha^j),$
where α is a primitive root.
Since s( x) is divisible by generator g( x), it follows that
 $s(\backslash alpha^i)\; =\; 0,\; \backslash \; i=1,2,\backslash ldots,nk$
The transmitted polynomial is corrupted in transit by an error polynomial e( x) to produce the received polynomial r( x).
 $r(x)\; =\; s(x)\; +\; e(x)$
 $e(x)\; =\; \backslash sum\_\{i=0\}^\{n1\}\; e\_i\; x^i$
where e_{i} is the coefficient for the ith power of x. Coefficient e_{i} will be zero if there is no error at that power of x and nonzero if there is an error. If there are ν errors at distinct powers i_{k} of x, then
 $e(x)\; =\; \backslash sum\_\{k=1\}^\backslash nu\; e\_\{i\_k\}\; x^\{i\_k\}$
The goal of the decoder is to find the number of errors ( ν), the positions of the errors ( i_{k}), and the error values at those positions ( e_{ik}). From those, e(x) can be calculated and subtracted from r(x) to get the originally sent message s(x).
The decoder starts by evaluating the polynomial as received at certain points. We call the results of that evaluation the "syndromes", S_{ j}. They are defined as:
\begin{align} S_j &= r(\alpha^j) = s(\alpha^j) + e(\alpha^j) = 0 + e(\alpha^j) = e(\alpha^j), \ j=1,2,\ldots,nk \\
 $$
&= \sum_{k=1}^{\nu} e_{i_k} \left( \alpha^{j} \right)^{i_k}\end{align}The advantage of looking at the syndromes is that the message polynomial drops out. In other words, the syndromes only relate to the error, and are unaffected by the actual contents of the message being transmitted. If the syndromes are all zero, the algorithm stops here and reports that the message was not corrupted in transit.
Error locators and error valuesFor convenience, define the error locators X_{k} and error values Y_{k} as:
 $X\_k\; =\; \backslash alpha^\{i\_k\},\; \backslash \; Y\_k\; =\; e\_\{i\_k\}$
Then the syndromes can be written in terms of the error locators and error values as
 $S\_j\; =\; \backslash sum\_\{k=1\}^\{\backslash nu\}\; Y\_k\; X\_k^\{j\}$
This definition of the syndrome values is equivalent to the previous since $(\backslash alpha^j)^\{i\_k\}\; =\; \backslash alpha\; ^\; \{j*i\_k\}\; =\; (\backslash alpha^\{i\_k\})^j\; =\; X\_k^j$.
The syndromes give a system of n − k ≥ 2 ν equations in 2 ν unknowns, but that system of equations is nonlinear in the X_{k} and does not have an obvious solution. However, if the X_{k} were known (see below), then the syndrome equations provide a linear system of equations that can easily be solved for the Y_{k} error values.
X_1^1 & X_2^1 & \cdots & X_\nu^1 \\ X_1^2 & X_2^2 & \cdots & X_\nu^2 \\ \vdots & \vdots && \vdots \\ X_1^{nk} & X_2^{nk} & \cdots & X_\nu^{nk} \\ \end{bmatrix} \begin{bmatrix} Y_1 \\ Y_2 \\ \vdots \\ Y_\nu \end{bmatrix} = \begin{bmatrix} S_1 \\ S_2 \\ \vdots \\ S_{nk} \end{bmatrix}
 $\backslash begin\{bmatrix\}$
Consequently, the problem is finding the X_{k}, because then the leftmost matrix would be known, and both sides of the equation could be multiplied by its inverse, yielding Y _{k}
Error locator polynomialThere is a linear recurrence relation that gives rise to a system of linear equations. Solving those equations identifies those error locations X_{k}.Define the error locator polynomial Λ( x) as
 $\backslash Lambda(x)\; =\; \backslash prod\_\{k=1\}^\backslash nu\; (1\; \; x\; X\_k\; )\; =\; 1\; +\; \backslash Lambda\_1\; x^1\; +\; \backslash Lambda\_2\; x^2\; +\; \backslash cdots\; +\; \backslash Lambda\_\backslash nu\; x^\backslash nu$
The zeros of Λ( x) are the reciprocals $X\_k^\{1\}$. This follows from the above product notation construction since if $x=X\_k^\{1\}$ then one of the multiplied terms will be zero $(1\; \; X\_k^\{1\}\; *\; X\_k)\; =\; 1\; \; 1\; =\; 0$, making the whole polynomial evaluate to zero. Explicitly:
 $\backslash Lambda(X\_k^\{1\})\; =\; 0$
 $\backslash Lambda(X\_k^\{1\})\; =\; 1\; +\; \backslash Lambda\_1\; X\_k^\{1\}\; +\; \backslash Lambda\_2\; X\_k^\{2\}\; +\; \backslash cdots\; +\; \backslash Lambda\_\backslash nu\; X\_k^\{\backslash nu\}\; =\; 0$
Multiply both sides by $Y\_k\; X\_k^\{j+\backslash nu\}$ and it will still be zero. j is any number such that $1\; \backslash leq\; j\; \backslash leq\; v$.
\begin{align} & Y_k X_k^{j+\nu} \Lambda(X_k^{1}) = 0. \\ & Y_k X_k^{j+\nu} (1 + \Lambda_1 X_k^{1} + \Lambda_2 X_k^{2} + \cdots + \Lambda_\nu X_k^{\nu}) = 0. \\ \text{Hence } & Y_k X_k^{j+\nu} + \Lambda_1 Y_k X_k^{j+\nu} X_k^{1} + \Lambda_2 Y_k X_k^{j+\nu} X_k^{2} + \cdots + \Lambda_{\nu} Y_k X_k^{j+\nu} X_k^{\nu} = 0, \\ \text{and so } & Y_k X_k^{j+\nu} + \Lambda_1 Y_k X_k^{j+\nu1} + \Lambda_2 Y_k X_k^{j+\nu 2} + \cdots + \Lambda_{\nu} Y_k X_k^j = 0 \\ \end{align}
 $$
Sum for k = 1 to ν
& \sum_{k=1}^\nu ( Y_k X_k^{j+\nu} + \Lambda_1 Y_k X_k^{j+\nu1} + \Lambda_2 Y_k X_k^{j+\nu 2} + \cdots + \Lambda_{\nu} Y_k X_k^{j} ) = 0 \\ \end{align}
 $\backslash begin\{align\}$
Collect each term into its own sum, and extract the constant values of $\backslash Lambda$ that are unaffected by the summation
& (\sum_{k=1}^\nu Y_k X_k^{j+\nu} ) + \Lambda_1 (\sum_{k=1}^\nu Y_k X_k^{j+\nu1}) + \Lambda_2 (\sum_{k=1}^\nu Y_k X_k^{j+\nu 2}) + \cdots + \Lambda_\nu (\sum_{k=1}^\nu Y_k X_k^j ) = 0 \end{align}
 $\backslash begin\{align\}$
Note that these summations are now equivalent to the syndrome values, which we know and can substitute in! This therefore reduces to
 $S\_\{j\; +\; \backslash nu\}\; +\; \backslash Lambda\_1\; S\_\{j+\backslash nu1\}\; +\; \backslash cdots\; +\; \backslash Lambda\_\{\backslash nu1\}\; S\_\{j+1\}\; +\; \backslash Lambda\_\{\backslash nu\}\; S\_j\; =\; 0\; \backslash ,$
Subtracting $S\_\{j+\backslash nu\}$ from both sides yields
 $S\_j\; \backslash Lambda\_\{\backslash nu\}\; +\; S\_\{j+1\}\backslash Lambda\_\{\backslash nu1\}\; +\; \backslash cdots\; +\; S\_\{j+\backslash nu1\}\; \backslash Lambda\_1\; =\; \; S\_\{j\; +\; \backslash nu\}\; \backslash $
Recall that j was chosen to be any integer between 1 and v inclusive, and this equivalence is true for any and all such values. Therefore, we have v linear equations, not just one. This system of linear equations can therefore be solved for the coefficients Λ_{ i} of the error location polynomial:
S_1 & S_2 & \cdots & S_{\nu} \\ S_2 & S_3 & \cdots & S_{\nu+1} \\ \vdots & \vdots && \vdots \\ S_{\nu} & S_{\nu+1} & \cdots & S_{2\nu1} \end{bmatrix} \begin{bmatrix} \Lambda_{\nu} \\ \Lambda_{\nu1} \\ \vdots \\ \Lambda_1 \end{bmatrix} = \begin{bmatrix}  S_{\nu+1} \\  S_{\nu+2} \\ \vdots \\  S_{\nu+\nu} \end{bmatrix} The above assumes the decoder knows the number of errors ν, but that number has not been determined yet. The PGZ decoder does not determine ν directly but rather searches for it by trying successive values. The decoder first assumes the largest value for a trial ν and sets up the linear system for that value. If the equations can be solved (i.e., the matrix determinant is nonzero), then that trial value is the number of errors. If the linear system cannot be solved, then the trial ν is reduced by one and the next smaller system is examined.
 $\backslash begin\{bmatrix\}$
Obtain the error locators from the error locator polynomialUse the coefficients Λ_{ i} found in the last step to build the error location polynomial. The roots of the error location polynomial can be found by exhaustive search. The error locators X_{k} are the reciprocals of those roots. Note that the order of coefficients of the error location polynomial can be reversed, in which case the roots of that reversed polynomial are the error locators $X\_k$ (not their reciprocals $X\_k^\{1\}$). Chien search is an efficient implementation of this step.
Calculate the error valuesOnce the error locators X_{k} are known, the error values can be determined. This can be done by direct solution for Y_{k} in the error equations matrix given above, or using the Forney algorithm.
Calculate the error locationsCalculate i_{k} by taking the log base $\backslash alpha$ of X_{k}. This is generally done using a precomputed lookup table.
Fix the errorsFinally, e(x) is generated from i_{k} and e_{ik} and then is subtracted from r(x) to get the sent message s(x).
ExampleConsider the Reed–Solomon code defined in with and (this is used in PDF417 barcodes) for a RS(7,3) code. The generator polynomial isIf the message polynomial is , then a systematic codeword is encoded as follows.
 $g(x)\; =\; (x3)(x3^2)(x3^3)(x3^4)\; =\; x^4+809\; x^3+723\; x^2+568\; x+522$
Errors in transmission might cause this to be received instead.
 $s\_r(x)\; =\; p(x)\; \backslash ,\; x^t\; \backslash mod\; g(x)\; =\; 547\; x^3\; +\; 738\; x^2\; +\; 442\; x\; +\; 455$
 $s(x)\; =\; p(x)\; \backslash ,\; x^t\; \; s\_r(x)\; =\; 3\; x^6\; +\; 2\; x^5\; +\; 1\; x^4\; +\; 382\; x^3\; +\; 191\; x^2\; +\; 487\; x\; +\; 474$
The syndromes are calculated by evaluating r at powers of α.
 $r(x)\; =\; s(x)\; +\; e(x)\; =\; 3\; x^6\; +\; 2\; x^5\; +\; 123\; x^4\; +\; 456\; x^3\; +\; 191\; x^2\; +\; 487\; x\; +\; 474$
 $S\_1\; =\; r(3^1)\; =\; 3\backslash cdot\; 3^6\; +\; 2\backslash cdot\; 3^5\; +\; 123\backslash cdot\; 3^4\; +\; 456\backslash cdot\; 3^3\; +\; 191\backslash cdot\; 3^2\; +\; 487\backslash cdot\; 3\; +\; 474\; =\; 732$
 $S\_2\; =\; r(3^2)\; =\; 637,\backslash ;S\_3\; =\; r(3^3)\; =\; 762,\backslash ;S\_4\; =\; r(3^4)\; =\; 925$
732 & 637 \\ 637 & 762 \end{bmatrix} \begin{bmatrix} \Lambda_2 \\ \Lambda_1 \end{bmatrix} = \begin{bmatrix} 762 \\ 925 \end{bmatrix} = \begin{bmatrix} 167 \\ 004 \end{bmatrix}
 $\backslash begin\{bmatrix\}$
Using Gaussian elimination:
001 & 000 \\ 000 & 001 \end{bmatrix} \begin{bmatrix} \Lambda_2 \\ \Lambda_1 \end{bmatrix} = \begin{bmatrix} 329 \\ 821 \end{bmatrix}
 $\backslash begin\{bmatrix\}$
The coefficients can be reversed to produce roots with positive exponents, but typically this isn't used:
 Λ(x) = 329 x^{2} + 821 x + 001, with roots x_{1} = 757 = 3^{−3} and x_{2} = 562 = 3^{−4}
with the log of the roots corresponding to the error locations (right to left, location 0 is the last term in the codeword).
 R(x) = 001 x^{2} + 821 x + 329, with roots 27 = 3^{3} and 81 = 3^{4}
To calculate the error values, apply the Forney algorithm.
 Ω(x) = S(x) Λ(x) mod x^{4} = 546 x + 732
 Λ'(x) = 658 x + 821
 e_{1} = Ω(x_{1})/Λ'(x_{1}) = 074
 e_{2} = Ω(x_{2})/Λ'(x_{2}) = 122
Subtracting e_{1} x^{3} and e_{2} x^{4} from the received polynomial r reproduces the original codeword s.
Berlekamp–Massey decoderThe Berlekamp–Massey algorithm is an alternate iterative procedure for finding the error locator polynomial. During each iteration, it calculates a discrepancy based on a current instance of Λ(x) with an assumed number of errors e:
 $\backslash Delta\; =\; S\_\{i\}\; +\; \backslash Lambda\_1\; \backslash \; S\_\{i1\}\; +\; \backslash cdots\; +\; \backslash Lambda\_e\; \backslash \; S\_\{ie\}$
and then adjusts Λ(x) and e so that a recalculated Δ would be zero. The article Berlekamp–Massey algorithm has a detailed description of the procedure. In the following example, C(x) is used to represent Λ(x).
ExampleUsing the same data as the Peterson Gorenstein Zierler example above:The final value of C is the error locator polynomial, Λ( x).
1 2 1 2
Euclidean decoderAnother iterative method for calculating both the error locator polynomial and the error value polynomial is based on Sugiyama's adaptation of the Extended Euclidean algorithm .Define S(x), Λ(x), and Ω(x) for t syndromes and e errors:
 $S(x)\; =\; S\_\{t\}\; x^\{t1\}\; +\; S\_\{t1\}\; x^\{t2\}\; +\; \backslash cdots\; +\; S\_2\; x\; +\; S\_1$
 $\backslash Lambda(x)\; =\; \backslash Lambda\_\{e\}\; x^\{e\}\; +\; \backslash Lambda\_\{e1\}\; x^\{e1\}\; +\; \backslash cdots\; +\; \backslash Lambda\_\{1\}\; x\; +\; 1$
 $\backslash Omega(x)\; =\; \backslash Omega\_\{e\}\; x^\{e\}\; +\; \backslash Omega\_\{e1\}\; x^\{e1\}\; +\; \backslash cdots\; +\; \backslash Omega\_\{1\}\; x\; +\; \backslash Omega\_\{0\}$
The key equation is:
 $\backslash Lambda(x)\; S(x)\; =\; Q(x)\; x^\{t\}\; +\; \backslash Omega(x)$
For t = 6 and e = 3:
\Lambda_3 S_6 & x^8 \\ \Lambda_2 S_6 + \Lambda_3 S_5 & x^7 \\ \Lambda_1 S_6 + \Lambda_2 S_5 + \Lambda_3 S_4 & x^6 \\
 $\backslash begin\{bmatrix\}$
S_6 + \Lambda_1 S_5 + \Lambda_2 S_4 + \Lambda_3 S_3 & x^5 \\ S_5 + \Lambda_1 S_4 + \Lambda_2 S_3 + \Lambda_3 S_2 & x^4 \\ S_4 + \Lambda_1 S_3 + \Lambda_2 S_2 + \Lambda_3 S_1 & x^3 \\ S_3 + \Lambda_1 S_2 + \Lambda_2 S_1 & x^2 \\ S_2 + \Lambda_1 S_1 & x \\ S_1 & \\\end{bmatrix} = \begin{bmatrix} Q_2 x^8 \\ Q_1 x^7 \\ Q_0 x^6 \\ 0 \\ 0 \\ 0 \\ \Omega_2 x^2 \\ \Omega_1 x \\ \Omega_0 \\ \end{bmatrix}The middle terms are zero due to the relationship between Λ and syndromes.
The extended Euclidean algorithm can find a series of polynomials of the form
A_{i}(x) S(x) + B_{i}(x) x^{t} = R_{i}(x)
where the degree of R decreases as i increases. Once the degree of R_{i}(x) < t/2, then
A_{i}(x) = Λ(x)
B_{i}(x) = Q(x)
R_{i}(x) = Ω(x).
B(x) and Q(x) don't need to be saved, so the algorithm becomes:
to set low order term of Λ(x) to 1, divide Λ(x) and Ω(x) by A_{i}(0):
 R_{−1} = x^{t}
 R_{0} = S(x)
 A_{−1} = 0
 A_{0} = 1
 i = 0
 while degree of R_{i} >= t/2
 :i = i + 1
 :Q = R_{i2} / R_{i1}
 :R_{i} = R_{i2}  Q R_{i1}
 :A_{i} = A_{i2}  Q A_{i1}
 Λ(x) = A_{i} / A_{i}(0)
 Ω(x) = R_{i} / A_{i}(0)
A_{i}(0) is the constant (low order) term of A_{i}.
ExampleUsing the same data as the Peterson Gorenstein Zierler example above:
1 001 x^{4} + 000 x^{3} + 000 x^{2} + 000 x + 000 000 0 925 x^{3} + 762 x^{2} + 637 x + 732 001 1 683 x^{2} + 676 x + 024 697 x + 396 2 673 x + 596 608 x^{2} + 704 x + 544
 Λ(x) = A_{2} / 544 = 329 x^{2} + 821 x + 001
 Ω(x) = R_{2} / 544 = 546 x + 732
Decoder using discrete Fourier transformA discrete Fourier transform can be used for decoding.Shu Lin and Daniel J. Costello Jr, "Error Control Coding" second edition, pp. 255262, 1982, 2004 To avoid conflict with syndrome names, let c(x) = s(x) the encoded codeword. r(x) and e(x) are the same as above. Define C(x), E(x), and R(x) as the discrete Fourier transforms of c(x), e(x), and r(x). Since r(x) = c(x) + e(x), and since a discrete Fourier transform is a linear operator, R(x) = C(x) + E(x).Transform r(x) to R(x) using discrete Fourier transform. Since the calculation for a discrete Fourier transform is the same as the calculation for syndromes, t coefficients of R(x) and E(x) are the same as the syndromes:
 $R\_j\; =\; E\_j\; =\; S\_j\; =\; r(\backslash alpha^j)$
 $for\; \backslash \; 1\; \backslash le\; j\; \backslash le\; t$
Use $R\_1$ through $R\_t$ as syndromes (they're the same) and generate the error locator polynomial using the methods from any of the above decoders.
Let v = number of errors. Generate E(x) using the known coefficients $E\_1$ to $E\_t$, the error locator polynomial, and these formulas
 $E\_0\; =\; \; \backslash frac\{1\}\{\backslash Lambda\_v\}(E\_\{v\}\; +\; \backslash Lambda\_1\; E\_\{v1\}\; +\; \backslash cdots\; +\; \backslash Lambda\_\{v1\}\; E\_\{1\})$
 $E\_j\; =\; (\backslash Lambda\_1\; E\_\{j1\}\; +\; \backslash Lambda\_2\; E\_\{j2\}\; +\; \backslash cdots\; +\; \backslash Lambda\_v\; E\_\{jv\})$
 $for\; \backslash \; t\; <\; j\; <\; n$
Then calculate C(x) = R(x)  E(x) and take the inverse transform (polynomial interpolation) of C(x) to produce c(x).
Decoding beyond the errorcorrection boundThe Singleton bound states that the minimum distance d of a linear block code of size ( n, k) is upperbounded by n − k + 1. The distance d was usually understood to limit the errorcorrection capability to ⌊ d/2⌋. The Reed–Solomon code achieves this bound with equality, and can thus correct up to ⌊( n − k + 1)/2⌋ errors. However, this errorcorrection bound is not exact.In 1999, Madhu Sudan and Venkatesan Guruswami at MIT published "Improved Decoding of Reed–Solomon and AlgebraicGeometry Codes" introducing an algorithm that allowed for the correction of errors beyond half the minimum distance of the code. It applies to Reed–Solomon codes and more generally to algebraic geometric codes. This algorithm produces a list of codewords (it is a listdecoding algorithm) and is based on interpolation and factorization of polynomials over $GF(2^m)$ and its extensions.
SoftdecodingThe algebraic decoding methods described above are harddecision methods, which means that for every symbol a hard decision is made about its value. For example, a decoder could associate with each symbol an additional value corresponding to the channel demodulator's confidence in the correctness of the symbol. The advent of LDPC and , which employ iterated softdecision belief propagation decoding methods to achieve errorcorrection performance close to the Shannon limit, has spurred interest in applying softdecision decoding to conventional algebraic codes. In 2003, Ralf Koetter and Alexander Vardy presented a polynomialtime softdecision algebraic listdecoding algorithm for Reed–Solomon codes, which was based upon the work by Sudan and Guruswami. In 2016, Steven J. Franke and Joseph H. Taylor published a novel softdecision decoder.
Matlab Example
EncoderHere we present a simple Matlab implementation for an encoder.

