Integrated circuit and method for processing coded message words

Abstract

The invention relates to an integrated circuit and a method for processing a coded message word. The integrated circuit has a receiver designed to receive a message word and an integrated hardware decoding circuit, which has: a calculation unit, which is designed to: calculate a syndrome of the message word according to a preset BCH code, wherein the syndrome has one or more syndrome elements in an extended field of a prime field; a logarithm operator, which is designed to find the logarithm of each syndrome element of the one or more syndrome elements; an arithmetic operation circuit, which is designed to find the logarithm of each zero point of one or more zero points of an error locator polynomial of the BCH code based on the logarithm of the one or more syndrome elements; and a bit inverter circuit, which is designed to invert one or more bits of the message word, whose bits are described by the logarithm of one or more zero points of the error locator polynomial. The integrated circuit also has a data processing circuit, which is designed to further process the message processed by the bit inverter circuit.

Description

Technical Field

[0001] Generally, embodiments relate to integrated circuits and methods for processing encoded message words. Background Art

[0002] Electronic circuits for safety-related applications, i.e., chip card modules and control processors in automobiles, for example, must be protected against attacks. In particular, it is typically desirable to be able to detect whether data stored in a memory, for example, a non-volatile memory, have been tampered with (or are otherwise erroneous) and to be able to correct them if necessary. A hardware implementation of such functions that requires a small chip area is desirable. Summary of the invention

[0003] According to one embodiment, an integrated circuit is provided, the integrated circuit having: a receiver, which is designed to receive a message word; and an integrated hardware decoding circuit. The hardware decoding circuit has: a calculation unit, the calculation unit is designed to: calculate a syndrome of the message word according to a preset BCH code, wherein the syndrome has one or more syndrome elements in an extended field of a prime field; a logarithm operator, the logarithm operator is designed to find the logarithm of each of the one or more syndrome elements; an arithmetic operation circuit, the arithmetic operation circuit is designed to find the logarithm of each of the one or more zero points of an error locator polynomial of the BCH code based on the logarithm of the one or more syndrome elements; and a bit inverter circuit, the bit inverter circuit is designed to invert one or more bits of the message word, the position of the bit being described by the logarithm of the one or more zero points of the error locator polynomial. The integrated circuit also has a data processing circuit, the data processing circuit is designed to further process the message processed by the bit inverter circuit.

[0004] According to another embodiment, a method for processing a coded message word according to the integrated circuit described above is proposed. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] The drawings do not depict actual size relationships, but are intended to illustrate the principles of different embodiments. In the following, different embodiments are described with reference to the following drawings.

[0006] Figure 1 A secure integrated circuit with non-volatile memory is shown.

[0007] Figure 2 A circuit is shown that implements a BCH encoder and a BCH decoder for 1-bit and 2-bit error cases.

[0008] Figure 3 An integrated circuit is shown.

[0009] Figure 4 A flow chart is shown which illustrates a method for processing an encoded message word. DETAILED DESCRIPTION

[0010] The following detailed description relates to the accompanying drawings, which show details and embodiments. The embodiments are described in detail so that those skilled in the art can implement the present invention. Other embodiments are also feasible and the embodiments can be changed in structure, logic and electricity without departing from the subject matter of the present invention. Different embodiments are not necessarily mutually exclusive, but different embodiments can be combined with each other to produce new embodiments. In the scope of this specification, the expressions "connect", "connect" and "couple" are used to describe direct and indirect connections, direct or indirect connections and direct or indirect couplings.

[0011] Figure 1 A secure integrated circuit (secure IC) 100 having a non-volatile memory 101 is shown.

[0012] The security IC 100 has a microprocessor 102, which can access a non-volatile memory 101 and can process the data stored therein. For this purpose, a mechanism is provided, which detects bit errors in the stored data and corrects them. According to various embodiments, a hardware circuit 103 is provided, which implements an error detection and error correction mechanism in hardware. The circuit 103 implements an encoder 104, which encodes the data to be stored in the memory 101 (in the form of data words, for example (bus) messages), that is, for the data words to be stored, the associated code words are determined according to a predetermined code, and the associated code words are then stored in the memory 101. For reading, the memory implements a decoder 105, which determines for the stored word: whether the stored word is a valid code word according to the predetermined code) or whether the stored word is not a valid code word and therefore contains errors. Depending on the number of errors and the number of errors that can be corrected according to the code, the decoder 105 corrects the stored word to a valid code word. The decoder 105 provides the valid code word to the microprocessor 102.

[0013] The security IC 100 is, for example, part of a control device (for example in a vehicle) or part of a chip card (with any form factor).

[0014] For example, EEPROM, flash memory, FeRAM, or RRAM (resistive random access memory) can be used as the nonvolatile memory 101 .

[0015] However, the use of non-volatile memory 101 in security IC 100 places increased demands on the mechanisms used for detecting and correcting bit errors in the stored data. For the safe operation of memory 101, error correction codes (ECC, Error Correcting Code) are typically required, which can effectively detect and correct at least all 1 and 2 bit errors. (This means: the minimum spacing of the codes used must be at least 5.) In this case, the data to be stored (for example in the form of messages) should be encoded and the data to be read (for example in the form of messages) should be decoded and error-corrected automatically by the hardware circuit 103 of the security IC 100. Therefore, a suitable implementation typically has the following characteristics:

[0016] The code used should have as few redundant bits as possible in order to minimize the additional space cost for storing the redundant information in the non-volatile memory 101 .

[0017] • Errors should be identified and corrected quickly. Error-free memory contents should not delay the read process, and more frequently occurring (eg 1-bit errors) error patterns should be corrected faster than less frequent error patterns.

[0018] • The circuitry 103 implementing the encoder and decoder should be minimized in terms of space requirements.

[0019] The encoding and decoding process should have small power and energy requirements.

[0020] According to various embodiments, it is provided that BCH codes (Bose-Chaudhuri-Hocquenghem codes) are implemented over the finite field GF(2) under given boundary conditions. According to one embodiment, this is implemented by a hardware circuit 103, ie encoding and error correction are performed according to the code.

[0021] The decoding of a linear code usually begins with the application of a check matrix of the code to a received message word that may contain errors (i.e., a word that can be read out of the memory 101 and transmitted via a bus, for example). The result of applying the check matrix to the message word is the syndrome of the message word. In the case of a BCH code, the syndrome generally represents a tuple of elements of a finite extension range. An error-free message word is a code word (i.e., a valid word of the code) and has a syndrome of 0 (that is, the elements of the extension range that form the syndrome are all equal to zero). In contrast, each error case to be identified and / or corrected is unambiguously associated with a syndrome value different from 0. When the association between an error case that occurs and the associated syndrome value is identified, errors in the received message word can be corrected.

[0022] A simple strategy for implementing a decoder is, for example, to tabulate the error cases to be corrected and the syndromes associated therewith. Such a table decoder can then determine the error pattern of the syndrome values ​​of the check matrix by looking up the table and correct the received words. Since for a code of length n and the number of syndromes to be distinguished for correcting up to s errors, the number of s ) grows, such a table has size O(n s log(n)) and the described procedure quickly becomes impractical when the codeword length is larger and / or when dealing with multiple bit errors.

[0023] The size of the required table can be reduced, for example by means of a Meggitt decoder, which however needs to process the words to be decoded symbolically, so that in particular the words cannot be processed efficiently in parallel or in larger blocks.

[0024] The opposite is possible: in O(n s ) calculation steps, all possible error cases are tested. It is then no longer necessary to store the syndromes for the error cases in a table. Of course, the algorithm for decoding becomes extremely slow due to the calculation of all possible error syndromes in an "on-the-fly" manner.

[0025] Between these two extremes, various compromises are possible between computing time and required chip area. However, more efficient decoding algorithms are often required in finite or extended fields, but require complex implementation of arithmetic operations (addition, multiplication and division) - these algorithms are therefore quite suitable for software implementation - or are based on a shift register structure - which can often be implemented efficiently in hardware, but at the same time requires a relatively high number of individual computing steps to perform the decoding.

[0026] The classification of BCH codes used below attributes the problem of decoding a codeword with s errors to the problem of decoding a codeword with s errors in the extended domain GF(2 e ) is calculated a number of times s on the so-called error locator polynomial. The coefficients of the polynomial are rational functions of the syndrome elements of the received codeword.

[0027] In order to obtain the e )[x], different techniques can be used. For polynomials up to degree 5, the search for zeros can be reduced to one or more table lookups for quadratic and cubic equations by appropriate rational transformations of the polynomial equations. The values ​​of these tables must then be mapped back to the original equations by means of inverse rational transformations. The size of the precomputed tables is O(e2 e), thus typically restricting the solution to fields with a smaller expansion degree e. In general, rational transformations of coefficients and zeros between different polynomial equations require an expansion of the field GF(2 e ) in order to reduce the computationally expensive operations involved, the corresponding decoder is therefore typically implemented in software.

[0028] In order to implement the e ) uses two main implementation techniques: the elements of the extended domain are either represented as elements of a vector space using coefficients from CF(2) or with respect to the primitive element α∈GF(2 e Here, we use the equivalent expression GF(2 e )=GF(2)[x] / <p(x)> =GF(2)[α]. Here, p∈GF(2)[x] is an irreducible polynomial with degree grad(p)=e in GF(2). Usually, the polynomial basis [1,x,x 2 ,x 3 ,…,x e-1} or the standard basis {1,x,x 2 ,x 4 ,…,x 2^(e-1)} is used as a basis for vector space expressions.

[0029] In vector space representation, GF(2 e ) (component-wise XOR operation of coefficient vectors in GF(2)), can be simply performed in the discrete logarithmic expression with respect to the primitive element α. e ) in the domain of elements (discrete logarithm modulo 2 e –1). In vector space representation, the coefficient vector in GF(2) is represented by {0,1} e bit string in binary expression or with the help of numbers {0,…,2 e –1} to identify.

[0030] In logarithmic expressions, the elements (different from 0) can be identified by their discrete logarithms using the numbers {0,…,2 e –2} and through the binary representation of the number with {0,1} e It is identified by the bit string in .

[0031] Assume that α is a 2 e –1≥n finite extension field GF(2 e ) has an order ord(α) = 2 e –1 primitive element and assume that e is an odd number. That is, GF(2 e )=GF(2)[α]. For element z∈GF(2e ) * , where z = α s , s = dlog(z) represents the discrete logarithm of z with base α. Without limiting the generality, it always applies in the following that 0 ≤ dlog(z) ≤ 2 e –2. By expanding the number of times e to be an odd number, the subsequent expressions of multiple digits are simplified. Otherwise, other differences must be considered.

[0032] The widely used discrete logarithm expression for the primitive base α is used to calculate the domain elements α of i and j i and α j The method of summing is to use the Zech logarithm table for fields with small expansion degree e. The Zech logarithm table for exponents 0 ≤ x ≤ 2 e -2 contains the discrete logarithm Z(x) = dlog(α x +1). The sum of domain elements with expressions i and j, where i ≠ j, is thus computed as dlog(α i +α j )=Z(i–j mod2 e –1)+j mod 2 e –1, so the applicable i +α j =(α i-j +1)α j The addition method is usually used in software for smaller extension areas.

[0033] Multiplication of field elements in vector space expressions is typically expensive in software and hardware. In the case of hardware implementation, this requires O(e 2 ) gates. In software, tables with small reduced multiples of the factors are often precomputed to speed up multiplication. Standard base expressions enable fast exponentiation of field elements. The square of a number in standard base expression then corresponds to a rotation of its coefficient expression.

[0034] To simplify the expression, in the following, the description is made on the n Encoding and decoding of (n, k, d) BCH codes of commonly used systematic encoding over GF(2) with codewords of , dimension k and minimum spacing d. The decoder described below requires only pre-computed tables of size O(n log(n)). The described techniques are not limited to a specific choice of code and can be varied in many ways.

[0035] The following notation is used: Assume that m1,…,m6∈GF(2)[x] are α,α 2 ,…,α 6The minimum polynomial of g1(x)=lcm(m1,…,m2), g2(x)=lcm(m1,…,m4) and g3(x)=lcm(m1,…,m6) are the generating polynomials g1(x), g2(x), g3(x)∈GF(2)[x] of the corresponding BCH code. (Here, lcm(x,y) represents the least common multiple of the polynomials x and y in GF(2)[x].) Thus, g1 with degree deg(g1)=e generates (2 e -1,2 e -1-e,3) BCH code C1, with degree deg(g2)=2e g2 generates (2 e -1,2 e -1-2e,5) BCH code C2, and g3 with degree deg(g3)=3e generates (2 e -1,2 e -1-3e,7)BCH code C3. Code C1 can correct 1-bit error, C2 can correct 2-bit error and C3 can correct 3-bit error. The syndrome of code C1 represents the extended field GF(2 e ), the syndrome of code C2 is represented by GF(2 e ) and the syndrome of code C3 represents the pair of elements from GF(2 e ) is a triplet of elements.

[0036] The principle working mode of BCH encoding according to one embodiment:

[0037] The system encoder 104 converts the message u of length d into (u d–1 ,…,u0) is interpreted as the polynomial u(x)=u d-1 x d-1 + ... + u1x + u0∈GF(2)[x] and calculate the remainder of the polynomial division r(x) = u(x)x from the associated polynomial of the received message u(x) and the generator polynomial g(x) in GF(2)[x] deg(g) mod g(x). Polynomial m(x)=u(x)x deg(g) +r(x) ​​coefficients form the codeword m=(m n-1 ,…,m0). After construction, m(x)mod g(x)=0 applies.

[0038] A simple hardware implementation of the encoder can be carried out, for example, by means of a linear feedback shift register (LFSR) with feedback function g(x). If the message u is shifted into the LFSR bit by bit (starting with the MSB in the 0 state, LFSR), then at the end the register contains r(x) as the sought coefficient of the state.

[0039] The principle working mode of BCH decoding according to one embodiment:

[0040] The decoder 105 converts the received message (e.g., the read storage word m=(m n-1 ,…,m0)) is interpreted as the polynomial m(x)=m n-1 x n-1 + ... + m1x + m0∈GF(2)[x]. The message m consists of the codeword w originally calculated and stored by the encoder, which is changed by the error pattern e. It applies that in the case of a bitwise XOR logic operation for the bit string (i.e. for the binary representation of w and e) Or for the corresponding polynomial over GF(2), m(x)=w(x)+e(x). Since the constructed code can correct up to a maximum of 3 bit errors, it is assumed that: e(x)=e1x p1 +e2x p2 +e3x p3 , where e1,e2,e3∈GF(2) and 0≤p1,p2,p3≤n–1 represent the locations of possible bit errors.

[0041] To decode the received message m, first the remainder r(x)=m(x)mod g(x) of the polynomial division is determined from the associated polynomial of the received message m(x) and the generator polynomial g(x) of the code used in GF(2)[x]. If the remainder r(x) is the zero polynomial, no correctable error has been detected and the message decoding is terminated.

[0042] Otherwise, the syndrome of the received message is calculated by extending the domain elements s1,…,s k ∈GF(2 e ) of tuples (s1,…,s k ) represents. The following relationship applies, s i = r(α i )=(m(x)mod g(x))(α i )=((w(x)+e(x))mod g(x))(α i )=e(α i ), where 1≤i≤k, because after constructing α,α 2 ,…,α k are the zeros of the generator polynomial g(x) used, and w(x) mod g(x) = 0 applies. The value k is dependent on the minimum spacing of the code to be calculated.

[0043] The remainder of division r(x) and the domain elements s1,…,s representing the syndrome kThe calculation of can be efficiently implemented as a matrix multiplication over GF(2). The calculation of the division remainder r(x) is performed as when calculating the remainder in the encoder 104. In particular, the same algorithm and thus the hardware of the encoder 104 can continue to be used (at least partially) for decoding the message.

[0044] To calculate the correction factor s i = r(α i ), where 1≤i≤k, precompute the matrix N i ∈{0,1} e x deg(g) , the j-th column of the matrix is ​​composed of the field element α ij The coefficient expression of is formed, where 0≤j≤deg(g)–1, where represents the elements of the extension field of a suitable basis expression (e.g. polynomial basis) over GF(2). This means in particular that the matrix multiplication with Ni can be implemented in hardware as a combinational circuit consisting of only XOR gates and AND gates. The following relationship then applies:

[0045] s i = r(α i )=N i r, where 1≤i≤k,

[0046] where r is the coefficient vector of the polynomial r(x).

[0047] In an implementation of a BCH decoder for correcting s-bit errors according to the textbook, then, the error locator polynomial λ(x)=λ is determined. s x s +λ s-1 x s-1 +…+λ1x+1∈GF(2 e )[x] s ,...,λ1∈GF(2 e ). Coefficient λ s ,...,λ1 is an element of the extended domain and can be used as a correction factor s j = r(α j ) is a rational function λ i =v i (s0,…,s k ) where 1≤j≤k. Then, the zero μ1 of the error location polynomial λ(x) = α -p1 ,μ2=α -p2 ,…,μ s =α -ps Get the position of the bit error to be corrected p1, p2, ..., p s The error position can finally be calculated by taking the discrete logarithm of the zero point to give p i = -dlog(μi )mod 2 e –1, where 1≤i≤s.

[0048] Various formulas and algorithms are available for computing the coefficients of the error locator polynomial and its zeros. Since the rational function v is evaluated in the usual form i And determine the zeros μ of the error location polynomial i is relatively expensive and requires an expansion of the domain GF(2 e ), so according to one embodiment another algorithm for decoding the received message is used. The decoder 105 according to the embodiment described below first determines what error condition exists, and then determines the zero point for each error condition using a specific pre-calculated table that minimizes the number of remaining arithmetic operations in the extended domain.

[0049] For each considered error case, the corresponding formula for an effective table decoder is now derived and the mode of operation of decoder 105 is described. In this case, all tables present have a size of O(n log(n)), where n is the length of the codeword.

[0050] The algorithm implemented by the decoder 105 in hardware form is described below as pseudo code.

[0051] 1-bit error condition:

[0052] In the case of a 1-bit error, for the syndrome s1=r(α)=e(α)=α p1 Therefore, to determine the error position only the discrete logarithm p1=dlog(s1) must be formed. The following algorithm can be used to decode a 1-bit error:

[0053]

[0054] The function DLOG[x] is valid for values ​​0≤x≤2 e .-.2 are precomputed and tabulated. To this end, the integers x and elements α of the extended domain are identified in an appropriate manner y , the integers and elements are expressed in terms of vector space representation as bit vectors over the base field GF(2). The size of this table is only O(n log(n)), where n is the length of the codeword. Since n≤ord(α)=2 e .-.1, so s1 does not become 0 in the case of a 1-bit error.

[0055] 2-bit error case:

[0056] In the case of 2-bit errors, the error locator polynomial has the general form λ(x)=λ2x 2+λ1x+1∈GF(2 e )[x]. Zero point μ1=α -p1 and μ2=α -p2 The positions p1 and p2 of the bit errors to be corrected are determined.

[0057] For example, the following linear equation system is obtained using the Peterson-Gorenstein-Zierler method as a formula for determining the coefficients of the error location polynomial:

[0058] s1λ2+s2λ1+s3=s3

[0059] s2λ2+s3λ1+s4=s4

[0060] The solution of the equation system is (s1s3+s2 2 )λ1=s1s4+s2s3 and (s1s3+s2 2 )λ2=s3 2 +s2s4. Dominant product term s1s3+s2 2 =α p1+p2 (α p1 +α p2 ) 2 corresponds to the determinant on the left side of the system of equations, and when the received codeword contains a 1-bit error, the dominant product term is 0. It will be further apparent below that it is not necessary to test for this case separately during the course of the algorithm.

[0061] By substitution, from λ(x) = 0 in GF(2 e ) to obtain the quadratic equation

[0062] (s3 2 +s2s4)x 2 +(s1s4+s2s3)x+s1s3+s2 2 =0 (1)

[0063] Since the expansion is based on the characteristic number 2, then s2 = s1 applies 2 ,s4=s1 4 And equation (1) can be further simplified for the case of 2-bit errors to

[0064] (s3+s1 3 )x 2 +s1 2 x+s1=0. (2)

[0065] The zeros of equation (2) can now be determined explicitly with the aid of the half-trace function. 3 =α p1+p2(α p1 +α p2 ) (the dominant coefficient is not 0, because a 2-bit error case is considered here) and the substitution x=s1 2 y / (s3+s1 3 ) then we get the following equation

[0066] y 2 +y=1+s3 / s1 3 (3)

[0067] The efficiency of the decoding algorithm described in more detail below results from the fact that equation (3) is only combined with the unique value s3 / s1 calculated from the syndrome element 3 Related.

[0068] The semitrace function is for the extended field GF(2 e ) by HT(x)=x+x 4 +x 16 +…+x 4 ^((e-1) / 2) Using this notation, when Tr(1+s3 / s1 is applied to the trace 3 )=0, the zero point of equation (3) is y1=HT(1+s3 / s1 3 ) and y2=HT(1+s3 / s1 3 )+1. Otherwise, the quadratic equation (3) is in GF(2 e ) has no solution.

[0069] Thus, the zero point of equation (2) is calculated as

[0070] μ1=HT(1+s3 / s1 3 ) / (s1(1+s3 / s1 3 )) (4)

[0071] and

[0072] μ2=(HT(1+s3 / s1 3 )+1) / (s1(1+s3 / s1 3 )). (5)

[0073] This means that the zeros μ1 and μ2 are therefore expressed as s1 and 1+s3 / s1 3 function.

[0074] By using GF(2 e ) and logarithmically calculating equations (4) and (5) using notations a = dlog(s1) and b = dlog(s3) yields the following equation:

[0075] -p1=dlog(μ1)=-aZ(b-3a)+dlog(HT(α Z(b-3a) ))mod 2 e .-.1

[0076] and

[0077] -p2=dlog(μ2)=-aZ(b-3a)+Z(dlog(HT(α Z(b-3a) )))mod 2 e .-.1

[0078] Here, Z() represents the already defined Zech logarithmic function.

[0079] The following algorithm can be used to decode 2-bit errors:

[0080]

[0081]

[0082] For the decoding algorithm implemented by the decoder, for values ​​0 ≤ x ≤ 2 e .-.2 Pre-calculate the function DLOG[x],Q1[x]=-Z(x)+dlog(HT(α Z(x) ))mod 2 e .-.1 and Q2[x]=-Z(x)+Z(dlog(HT(α Z(x) )))mod 2 e .-.1, and tabulate. To this end, the integers x and elements α of the extended domain are identified in an appropriate manner y , the integers and elements are expressed in terms of vector space representation as bit vectors over the base field GF(2). The size of this table is only O(n log(n)), where n is the length of the codeword. Since n≤ord(α)=2 e -1, so s1 can also be non-0 in the case of a 2-bit error. Syndrome element s3 can be non-0 in the case of a 2-bit error, because: s3 = α 3p1+3p2 =s1(α 2p1 +α p1+p2 +α 2p2 )=s1α 2p2 (α 2p1-2p2 +α p1-p2 +1). Since the first two factors on the right side in the case of a 2-bit error are different from 0 and the quadratic term in the case of an odd expansion number does not have a root (Tr(1)≠0), the following assertion is obtained.

[0083] When the values ​​Q1[x] and Q2[x] are stored as pairs in a single table, steps 9 and 10 of the above algorithm can be parallelized. Similarly, steps 13 and 14 can be parallelized.

[0084] The above algorithm has the following characteristics:

[0085] Only operations required: matrix multiplication, table lookup, and subtraction modulo 2 over GF(2) e –1, where e is the expansion of the finite field. All operations used can be efficiently implemented in hardware and can also be performed in parallel at multiple locations. This allows fast decoding of erroneous messages.

[0086] Logarithmic calculations are performed by solving equations of quadratic error locator polynomials, without requiring arithmetic operations in the extended domain in vector space expressions. In particular, it is possible to discard GF(2 e ) in the corresponding division.

[0087] The size of the table used grows only with O(n log(n)). Thus, the space requirement of the decoder 105 is reduced.

[0088] Eliminate the Chien-Suche search for determining the zeros of the error locator polynomial. The Chien-Suche search uses Horner-Schemas to test all elements of the extension domain: whether they are zeros, and the Chien-Suche search is therefore only effective for very small dilation orders.

[0089] 3-bit error condition

[0090] In the case of 3-bit errors, the error locator polynomial has the general form λ(x)=λ3x 3 +λ2x 2 +λ1x

[0091] +1∈GF(2 e )[x]. Zero point μ1=α -p1 ,μ2=α -p2 and μ3=α -p3 The positions p1, p2 and p3 of the bit errors to be corrected are determined.

[0092] For example, the following linear system of equations is obtained using the Peterson-Gorenstein-Zierler method as a formula for determining the coefficients of the error location polynomial:

[0093] s1λ3+s2λ2+s3λ1=s4

[0094] s2λ3+s3λ2+s4λ1=s5

[0095] s3λ3+s4λ2+s5λ1=s6

[0096] Since the expansion is based on the characteristic number 2, then s2 = s1 applies 2 ,s4=s1 4 and s6 = s3 2 The solution of the equations is λ1=s1,(s1 3 +s3)λ2=s1 2 s3+s5 and (s1 3 +s3)λ3=(s1 6 +s1 3 s3+s5s1+s3 2 ). Because s1 is applicable 3 +s3=(α p1 +α p2 )(α p1 +α p3 )(α p2 +α p3 ), so in case of 3 bit errors the factor s1 3 +s3 is different from 0 and the error location polynomial is obtained as:

[0097] λ(x)=(s1 6 +s1 3 s3+s5s1+s3 2 ) / (s1 3 +s3)x 3 +(s1 2 s3+s5) / (s1 3 +s3)x 2 +s1x+1.

[0098] Now, consider the “mirrored” error locator polynomial η(x)=x 3 λ(1 / x)=x 3 +λ1x 2 +λ2x+λ3, the error locator polynomial has zeros and Using the polynomial η(x), if the zero point of η(x)=0 is determined, a significantly simpler rational transformation of the coefficients results in the following derivation than with the aid of classical procedures.

[0099] By substituting x=y+s1, we get the equation from η(x)=0

[0100] y 3 +(s1 5 +s5) / (s1 3 +s3)y+s1 3 +s3=0.

[0101] By substituting y = sqrt((s1 5 +s5) / (s1 3 +s3))z (where sqrt(.) calculates the square root function) to obtain the equation

[0102] z 3 + z = sqrt((s1 3 +s3) 5 / (s1 5 +s5) 3 ). (6)

[0103] Here, sqrt(x) computes x∈GF(2 e ) is the unambiguous square root of .

[0104] In the case of an odd expansion order e, the term s1 in the denominator of equation (6) 5 +s5 is not 0 in the case of a triple bit error. To illustrate this, use equation s1 5 +s5=(s1 3 +s3)(α 2p1 +α 2p2 +α 2p3 +α p1+p2 +α p1+p3 +α p2+p3 ). By substituting α p2 =(β+1)α p1 and α p3 =(γ+1)α p1 Get s1 5 +s5=α 2p1 (s1 3 +s3)(β 2 +γ 2 +βγ). By further substituting γ=δβ, we get s1 5 +s5=α 2p1 β 2 (s1 3 +s3)(δ 2 +δ+1). Since the square factors in δ do not have zero points (Tr(1)≠0) when the expansion number e is an odd number and since the remaining factors differ from 0 in the case of a 3-bit error, the following assertion is obtained.

[0105] The efficiency of the decoding algorithm described in more detail below results from the fact that equation (6) is only combined with the unique value (s1) calculated from the syndrome element. 3 +s3) 5 / (s1 5 +s5) 3 Related.

[0106] In contrast to the error cases considered so far, it is now absolutely possible that in the case of a 3-bit error the syndrome elements s1, s3 or s5 can assume the value 0. Therefore, the following cases are distinguished:

[0107] 1. Case s1≠0, s3≠0 and s5≠0:

[0108] Assume that ξ1, ξ2 and ξ3 are equations z 3 + z = sqrt((1 + s3 / s1 3 ) 5 / (1+s5 / s1 5 ) 3 ), the equation is derived from (6). Thus, is the sought zero of the “mirror” error locator polynomial η(x), where 1≤i≤3.

[0109] This means: Zero and Can be expressed as s1,1+s3 / s1 3 and 1+s5 / s1 5 By using GF(2 e ) and logarithms with the notation a = dlog(s1), b = dlog(s3) and c = dlog(s5) for error positions p where 1 ≤ i ≤ 3 i Get the equation Here, the function W i (x) represents the equation z 3 +z=α x The logarithm of the zeros of , where 1≤i≤3, and Z() is the already defined Zech logarithmic function. In addition, using: GF(2 e ) is linear.

[0110] 2. If s1=0, s3≠0 and s5≠0:

[0111] Assume that ξ1, ξ2 and ξ3 are equations z 3 + z = sqrt(s3 5 / s5 3 ), the equation is derived from (6). Thus, is the zero point sought for the "mirror" error locator polynomial η(x), where 1≤i≤3. This means: the zero point and Therefore, it can be expressed as a function of s3 and s5. By using GF(2 e) and logarithmically calculated using the notation b = dlog(s3) and c = dlog(s5), for error positions p where 1 ≤ i ≤ 3 i Get the equation Here, the function W i (x) represents the equation z 3 +z=α x The logarithm of the zeros of , where 1≤i≤3, and Z() is the already defined Zech logarithmic function. In addition, using: GF(2 e ) is linear.

[0112] 3. If s1≠0, s3=0 and s5≠0:

[0113] Assume that ξ1, ξ2 and ξ3 are equations z 3 + z = sqrt((1 / (1+s5 / s1 5 ) 3 ), the equation is derived from (6). Thus, is the zero point sought for the "mirror" error locator polynomial η(x), where 1≤i≤3. This means: the zero point and So it can be expressed as s1und 1+s5 / s1 5 By using GF(2 e ) and logarithm with the notation a = dlog(s1) and c = dlog(s5), for error positions p where 1 ≤ i ≤ 3 i Get the equation Here, the function W i (x) represents the equation z 3 +z=α x The logarithm of the zeros of , where 1≤i≤3, and Z() is the already defined Zech logarithmic function. In addition, using: GF(2 e ) is linear.

[0114] 4. If s1≠0, s3≠0 and s5=0:

[0115] This situation is handled similarly to situation 3.

[0116] 5. If s1≠0, s3=0 and s5=0:

[0117] Assume that ξ1, ξ2 and ξ3 are equations z 3 +z=1, the equation is derived from (6). Thus, is the zero point sought for the "mirror" error locator polynomial η(x), where 1≤i≤3. This means: the zero point and Therefore, it can be expressed as a function of s1. By using GF(2 e ) and logarithm calculation using the notation a = dlog(s1), for error positions p where 1 ≤ i ≤ 3 i Get the equation Here, the function W i (x) represents the equation z 3 + z = α x The logarithm of the zeros of , where 1≤i≤3, and Z() is the already defined Zech logarithmic function.

[0118] If applicable, s1 = 0 or s1 6 +s1 3 s3+s5s1+s3 2 ≠0, then there is a 3-bit error. As already explained in detail above, s1 will not be 0 in the case of 1-bit and 2-bit errors, because n≤ord(α)=2 applies. e .-.1 (where n is the length of the codeword). On the other hand, s1 6 +s1 3 s3+s5s1+s3 2 =α p1+p2+p3 (α p1 +α p2 )(α p1 +α p3 )(α p2 +α p3 ), and thus will not be 0 in the case of a 3-bit error. With the help of variant s1 6 +s1 3 s3+s5s1+s3 2 =s1 6 ((1+s3 / s1 3 ) 2 +(1+s3 / s1 3 )+(1+s5 / s1 5 )) and by using GF(2 e ) in which the discrete logarithm with base α and the logarithm a = dlog(s1), b = dlog(s3), c = dlog(s5), d = Z[b–3a mod 2 e –1] and e=Z[c–5a mod 2 e–1] performs logarithmic calculations to obtain the expression s1≠0&&Z[d]+d=e as the test condition for 1-bit or 2-bit error conditions. Here, Z() is the defined Zech logarithmic function.

[0119] The following algorithm can be used to decode 3-bit errors:

[0120]

[0121]

[0122] To decode, for values ​​0 ≤ x ≤ 2 e .-.2 Precompute the functions DLOG[x], Z[x], W1[x], W2[x] and W3[x] and tabulate them. To this end, identify the integer x and the element α of the extended domain in a suitable manner. y , the integers and elements are expressed in terms of vector space representation as bit vectors over the base field GF(2). The size of the table is only O(n log(n)), where n is the length of the codeword.

[0123] In the calculation of x / 2 mod 2 e –1 The halving step from 16 to 18 is modulo 2 e –1 (Halbierungsschritte modulo) (ie, the square root of the computation field element) can be attributed to addition modulo 2 as follows e –1 and shift operation:

[0124] 1. If LSB(x) = 1, then x←x+2 e –1;

[0125] 2.x←x>>1 / *After the first step, always MSB(x)=0* /

[0126] If the values ​​W1[x], W2[x] and W3[x] are each a triplet in a single table, then steps 13 to 15 in the above decoding algorithm can be parallelized. Similarly, steps 19 to 21 can be parallelized.

[0127] The above decoding algorithm has the following characteristics:

[0128] Only operations required: matrix multiplication, table lookup, and addition and subtraction modulo 2 over GF(2) e –1, where e is the expansion of the finite field. All operations used can be efficiently implemented in hardware and can also be performed in parallel on multiple bits. This allows fast decoding of erroneous messages.

[0129] By performing logarithmic calculations on the solution equations of the “mirrored” cubic error locator polynomial, no arithmetic operations in the extended domain are required in the vector space expression. In particular, it is possible to discard the GF(2 e ) in the corresponding division.

[0130] The size of the table used grows only with O(n log(n)). Thus, the space requirement of the decoder 105 is reduced.

[0131] Eliminate the Chien-Suche search for determining the zeros of the error locator polynomial. The Chien-Suche search uses Horner-Schemas to test all elements of the extension domain: whether they are zeros, and the Chien-Suche search is therefore only effective for very small dilation orders.

[0132] Higher-order error cases:

[0133] Usually it is possible to solve GF(2 e ) above. The described processing method for implementing the table decoder can thereby also be applied in principle to 4-bit and 5-bit error situations. Of course, it is no longer feasible to reduce the calculation of the zero points of the corresponding error location polynomial to a single polynomial equation in a standardized form, which is only still related to a single value calculated from the syndrome element. Instead, the calculation of the zero points of the polynomials of degree 4 and 5 can be reduced to the solution of a plurality of polynomial calculations of degree 3 and 2. The zero points of this derived polynomial equation with a reduced degree can then be determined similarly with the aid of the already described technology. Therefore, overall, for 4-bit and 5-bit error situations, a plurality of rational changes must be calculated to determine the coefficients of the different polynomial equations, including substitution. It can therefore be based on the fact that the complexity and algorithm expenditure of the implementation in hardware are significantly increased compared to the 1-bit to 3-bit error situations.

[0134] In the case of a 4-bit error, the error locator polynomial has the general formula λ(x)=λ4x 4 +λ3x 3 +λ2x 2 +λ1x+1∈GF(2 e )[x]. Zero point μ1=α -p1 , μ2=α -p2 , μ3=α -p3 and μ4=α -p4 Positions p1, p2, p3, and p4 of bit errors to be corrected are determined.

[0135] For example, the following linear system of equations is obtained using the Peterson-Gorenstein-Zierler method as a formula for determining the coefficients of the error location polynomial:

[0136] s1λ4+s2λ3+s3λ2+s4λ1=s5

[0137] s2λ4+s3λ3+s4λ2+s5λ1=s6

[0138] s3λ4+s4λ3+s5λ2+s6λ1=s7

[0139] Since the expansion is based on the characteristic number 2, then s2 = s1 applies 2 , s4=s1 4 and s6 = s3 2 The solution of the equations is λ1=s1, (s1 6 +s1 3 s3+s1s5+s3 2 )λ2=s1 8 +s1 5 s3+s1s7+s3s5, (s1 6 +s1 3 s3+s1s5+s3 2 )λ3=s1 6 s3+s1 4 s5+s1 2 s7+s3 3 and (s1 6 +s1 3 s3+s1s5+s3 2 )λ4=s1 10 +s1 7 s3+s1 5 s5+s1 3 s7+s1 2 s3s5+s1s3 3 +s3s7+s5 2 .

[0140] Under the assumption s1 6 +s1 3 s3+s1s5+s3 2 ≠0 and s1≠0 apply, resulting in a "mirrored" error location polynomial

[0141] η(x)=x 4 +s1x 3 +(s1 8 +s1 5 s3+s1s7+s3s5) / (s1 6 +s1 3 s3+s1s5+s3 2 )x 2 +(s1 6 s3+s1 4s5 + s1 2 s7 + s3 3 ) / (s1 6 + s1 3 s3 + s1s5 + s3 2 )x + (s1 10 + s1 7 s3 + s1 5 s5 + s1 3 s7 + s1 2 s3s5 + s1s3 3 + s3s7 + s5 2 ) / (s1 6 + s1 3 s3 + s1s5 + s3 2 )。

[0142] By substituting x = s1y, s3 = s1 3 (α + 1), s5 = s1 5 (β + 1) and s7 = s1 7 (γ + 1), the equation

[0143] y 4 + y 3 +(αβ + β + γ) / (α 2 + α + β)y 2 +(α 3 + α 2 + β + γ) / (α 2 + α + β)y + (α 3 + α 2 + αβ + αγ + β 2 ) / (α 2 + α + β) = 0 (7)

[0144] By substituting z = y + sqrt((α 3 + α 2 + β + γ) / (α 2 + α + β)), the equation

[0145] z 4 + z 3 +(αβ + β + γ) / (α 2 + α + β)z 2 + sqrt((α 3 + α 2 + β + γ) / (α 2 + α + β))z 2 + α 2 + α + β = 0(8)

[0146] If equation (8) is divided by the constant term, then the expression π(z 4 + z3 )+ρz 2 +1=0. To solve the equation, use the formula (sz 2 +vz+1)(uz 2 +vz+1)=su z 4 +v(s+u)z 3 +(s+u+v 2 ) 2 +1=0. By balancing the coefficients, we get a nonlinear system of equations.

[0147] su=π,v(s+u)=π and s+u+v 2 =ρ. (9)

[0148] From this system of equations, we can directly obtain v 3 +ρv=π, which can be solved by the technique already described for the 3-bit error case. If ξ is a solution, then v=sqrt(ρ)ξ applies. By substituting into (9), from x 2 +π / vx+π=0. Using the technique described for the 2-bit error case, we can now solve the equation (sz) in the following way: 2 +vz+1)(uz 2 +vz+1)=0 solution: that is, solve the two quadratic equations. From the four zeros, the zeros of the "mirror" error locator polynomial are calculated by reversing the corresponding substitutions, and the discrete logarithm of the zeros gives the error position. Thus, GF(2 e ) to solve the cubic and three quadratic equations in .

[0149] For the case s1=0, the simplified “mirror” error locator polynomial η(x)=x can be determined in a similar manner: 4 +s5 / s3x 2 +s3x+(s3s7+s5 2 ) / s3 2 Here, we can use the solution formula (z 2 +vz+s)(z 2 +vz+u)=0.

[0150] In order to perform different rational coefficient transformations, a very large number of e ) in the calculation operation.

[0151] In the following embodiments, the system encoder 104 operates on data words of fixed width b (e.g., b=32). For this purpose, it is assumed that g(x)∈GF(2)[x] is the generating polynomial of the BCH code, and u=(u t–1 ,…,u0) is a i ∈{0,1}b message, where 0≤i≤t–1, assuming M1∈{0,1} deg(g)x b is a matrix whose jth column contains the polynomial remainder x b+ j The coefficient expression of mod g(x), where 0≤j≤b–1, and assuming M2∈{0,1} deg(g)x b is a matrix whose jth column contains the polynomial remainder x deg(g)+j The coefficient expression of mod g(x) with 0≤j≤b–1. This means in particular that the matrix multiplication with M1 and M2 can be implemented in hardware as a combinational circuit consisting of only XOR gates and AND gates. The following relationship then applies

[0152] r(x)=u(x)x deg(g) mod g(x)=M2(…(M1(M1(M1u t–1 +u t–2 )+u t–3 )+…)+u0).

[0153] The following algorithm computes the division remainder r(x):

[0154]

[0155] If t(b+1)≤n applies, then the algorithm can be simplified to:

[0156]

[0157] Thus, the encoded message has the form u0 b By formally extending the message u by b symbols, the use of the matrix M2 can be dispensed with. Then, the division remainder r(x) satisfies the condition r(x)=u(x)x b mod g(x). This simplifies the implementation of encoder 104 since the use of matrix M2 in the course of the algorithm and the distinction between the cases for data word u0 can be dispensed with.

[0158] In another embodiment, the generator polynomial g(x)=lcm(m1, ..., m k ) of the minimal polynomial m1,…,m k∈GF(2)[x], so that the matrix M1 has, for example, the minimum weight (that is to say, the minimum number of elements different from 0). As a result, the chip area required for implementing the matrix M1 and the current consumption during the evaluation of the matrix are minimized. Another or further optimization criterion can, for example, be to minimize the maximum number of elements different from 0 in a row of the matrix, wherein the maximum is achieved with respect to all rows of the matrix. As a result, the time required for calculating the matrix multiplication can be minimized. For the matrix M2, there are corresponding optimization possibilities.

[0159] In an embodiment of the decoder 105, the pre-computed tables are implemented as ROM (read only memory) tables or synthesized as combinatorial circuits. The choice of implementation can be used to optimize space requirements and / or computation speed.

[0160] In one embodiment of the decoder 105, the chip area required for implementing the decoder can be further reduced when the table for calculating the discrete logarithm and the circuit for calculating the modular subtraction are implemented only once. The corresponding working steps must then be performed sequentially.

[0161] In one embodiment, the chip area required for implementing the decoder 105 can be further reduced when the circuits for implementing the required ROM tables (e.g. for the discrete logarithm DLOG[x], for calculating the zeros of the "mirrored" cubic error locator polynomials W1[x], W2[x] and W3[x], for the Zech logarithm Z[x], if any) have a common address decoder. Subsequently, other previously parallel working steps may have to be performed sequentially.

[0162] In one embodiment, the decoder 105 tests for the 2-bit error case whether the conditions r(x)≠0 and s1 = 0 are met. In this case, the decoder 105 finds uncorrectable multiple errors.

[0163] In the embodiment of the decoder 105 for the 2-bit error case, it is noted in the table for calculating the zeros of the quadratic error locator polynomials Q1[x] and Q2[x] when a specific value is used for the argument x: for the trace Tr(α Z(x) )=1 and hence the value 0≤x≤2 e –2 cannot appear as a zero of the equation for the transformation of the error location polynomial, where the specific value cannot appear as a calculated discrete logarithm (e.g. 2 e -1). If the table lookup for q1 or q2 in step 9 or 10 provides this specific value, the decoder 105 finds an uncorrectable multiple error. It is sufficient here to check the result of the table lookup. In a similar manner, invalid values ​​of other used tables can be encoded (for example DLOG[0] and Z[0]).

[0164] In the embodiment of the decoder 105 for the 2-bit error case, the test and correction of the 1-bit error case can be performed in hardware by testing all the associated remainders r(x)=x in parallel. p1 mod g(x). The decoder 105 can then correct the 1-bit error without further delay. The chip area required for this increases by O(n log(n)).

[0165] In the embodiment of the decoder 105 for the 2-bit error case, the test for the 1-bit error case can be performed by checking the spread field GF(2 d ) in the equation s3=s1 3 If they are consistent, then there is a 1-bit error condition. When the field element s1 is calculated by an appropriate circuit 3 , then a 1-bit error can be corrected more quickly in this processing approach.

[0166] In the embodiment of decoder 105 for the 2-bit error case, 3a mod 2 e The value of -1 is tabulated and read out during table lookup together with the determination of a=dlog(s1).

[0167] In an embodiment of the decoder 105 for the 3-bit error case, the calculation of GF(2 e ) (i.e., halving modulo 2 in steps 16 to 18 e –1 halved): that is, the root function has been incorporated into the logarithmic table DLOG[]. The following algorithm can then be used to decode 3-bit errors:

[0168]

[0169]

[0170] To decode, for values ​​0 ≤ x ≤ 2 e .-.2 Precompute the functions HDLOG[x], Z[x], W1[x], W2[x] and W3[x] and tabulate them. To this end, identify the integers x and elements α of the extended domain in a suitable manner. y , the integers and elements are expressed as bit vectors over the base field GF(2) with respect to the vector space expression. The size of this table is only O(n log(n)), where n is the length of the codeword.

[0171] Here, the function HDLOG[x] is the discrete logarithm of the root of x, that is, for 0 ≤ x ≤ 2 e .-.2,HDLOG(x)=dlog(sqrt(x))=dlog(x) / 2mod 2 e–1.

[0172] In another embodiment of the decoder for the 3-bit error case, test s1 6 +s1 3 s3+s5s1+s3 2 ≠0 whether there is a 3-bit error situation or a 2-bit error situation or a 1-bit error situation (under the condition s1≠0) can be implemented as follows: because s1 is applicable 6 +s1 3 s3+s5s1+s3 2 =s1 6 (s3 / s1 3 (1+s3 / s1 3 )+(1+s5 / s1 5 ), using the notation described above, is calculated:

[0173]

[0174]

[0175] In another embodiment of the decoder for the 3-bit error case, test s1 6 +s1 3 s3+s5s1+s3 2 ≠0 whether there is a 3-bit error condition or a 2-bit error condition or a 1-bit error condition (under the condition s1≠0) using the equation for the quadratic equation x 2 +x = c can be implemented as follows: Assume V[X] = dlog(y) where y 2 +y=α X is a table of logarithms of solutions to quadratic equations. (For cases where the quadratic equation has no solution, specific values ​​are recorded that cannot appear as discrete logarithms for calculation (e.g. 2 e -1). ) Then, for example, using the notation introduced above, we calculate:

[0176]

[0177] In an embodiment of the decoder for the 3-bit error case, it can be noted in the table of zeros of the cubic equations W1[x], W2[x] and W3[x] for calculating the transformations for which there is no solution for a specific value for the independent variable x, wherein the specific value cannot appear as a discrete logarithm for the calculation (e.g. 2 e-1). If the table lookup for q1, q2 or q3 in step 13 or 15 provides this specific value, then the decoder has discovered an uncorrectable multiple error. It is sufficient here to check the result of the table lookup. In another variant, a specific independent variable (e.g. 2) is only used when the cubic equation has less than three solutions. e -1). Because, the cubic equation has only GF(2 e ) also leads to uncorrectable multiple errors.

[0178] In an embodiment capable of decoding all code words with up to 3 bit errors, the area required for implementing the tables can be reduced if only the tables DLOG[x], Z[x], V[x], W1[x], W2[x] and W3[x] are implemented instead of the above-described process for decoding 1-bit errors, 2-bit errors and 3-bit errors using the tables DLOG[x], Z[x], Q1[x], Q2[x], W1[x], W2[x] and W3[x]. The values ​​of the tables Q1[x] and Q2[x] are then calculated using the tables Z[x] and V[x] when necessary. This variant requires more table lookups than the above-described embodiment for correcting 2-bit errors.

[0179] Figure 2 A circuit 200 is shown that implements a BCH encoder and a BCH decoder for 1-bit and 2-bit error cases.

[0180] Circuit 200 can be used, for example, as circuit 103 in security IC 100. In the embodiment variant shown, messages are processed in blocks of fixed width and the value 3dlog(x) is determined by looking up in a precalculated table.

[0181] The circuit 200 has a first exclusive-OR (XOR) gate 201, the input of which receives an input bit u i The second input of the XOR gate 201 is connected to the output of the AND gate 202. The output of the first XOR gate 201 is output to the first multiplier, which performs a multiplication with the matrix M1. The result of the multiplication is stored in the register r204. For encoding, the bits stored in the register r204 form the bits of the generated codeword.

[0182] AND gate 202 receives the start bit and the bits stored in register r 204. For decoding, the bits stored in register r are supplied to a second XOR gate 205, which receives the redundant part of the received message to be decoded at its second input. The bits output by the second XOR gate 205 are output to a second multiplier 206, which performs a multiplication with the matrix N1, and to a third multiplier 207, which performs a multiplication with the matrix N3.

[0183] The outputs of the second multiplier 206 and the third multiplier 207 are supplied together with the contents of register c 298 to a multiplexer (or selection circuit) 209 which, under the control of a control device 210, calculates an index to a table 211 so that the correct entry of the table is output as it is currently evaluated according to the decoding algorithm. Table 211 stores DLOG[x], 3DLOG[x], Q0[x] and Q1[x] for different independent variables.

[0184] The result of DLOG[x] is stored in register a 212 (when s1 was used for pointer 211 ) or output as value b (when s3 was used for pointer 211 ). One of the values ​​is supplied to subtractor 214 via first multiplexer 213 controlled by control device 210 .

[0185] The result of 3DLOG[x] is stored in register 3a 215. The second multiplexer 216 controlled by the control device 210 outputs the value stored in the register 215, the result of Q0[x], the result of Q1[x], or the value 0 to the subtractor 214.

[0186] Subtractor 214 performs a modulo 2 operation on its input. e The output of the subtractor 214 is stored in register c, depending on which bit of the algorithm the processing occurs, or indicates the position of the error in the received message.

[0187] In summary, according to different implementations, an integrated circuit is provided, such as Figure 3 Shown in.

[0188] Figure 3 An integrated circuit 300 is shown.

[0189] Integrated circuit 300 has a receiver 301 which is designed to receive a message word.

[0190] In addition, the integrated circuit 300 has an integrated hardware decoding circuit 302, which has: a calculation unit (for example, a multiplier 303), which is designed to calculate the syndrome of the message word according to a preset BCH code, wherein the syndrome has one or more syndrome elements in an extended field of a prime field; a logarithm operator 304, which is designed to calculate the logarithm of each of the one or more syndrome elements; an arithmetic operation circuit 305, which is designed to calculate the logarithm of each of the one or more zero points of the error locator polynomial of the BCH code based on the logarithm of the one or more syndrome elements; and a bit inverter circuit 306, which is designed to invert a bit of the message word, the position of the bit being described by the logarithm of the one or more zero points of the error locator polynomial.

[0191] The integrated circuit 300 further has a data processing circuit 307 which is designed to further process the message words processed by the bit inverter circuit.

[0192] Therefore, according to various embodiments, a logarithm calculation is already performed as early as in the decoding device. Thus, the logarithm of the syndrome element is taken.

[0193] In this way, the logarithm is taken into account in the following calculations, thereby avoiding the need to perform extended-range arithmetic operations. The implementation of extended-range arithmetic operations is typically carried out with the aid of a programmable microprocessor, since dedicated hardware circuits (i.e. hard-wired circuits) have an excessively large area consumption. Instead of a programmable microprocessor, according to reference Figure 3 The described approach allows for the implementation of field arithmetic operations to be avoided by providing dedicated hardware circuits that perform the decoding. Thus, for example, the calculation unit, the logarithm operator, the arithmetic operation circuit and the bit inverter circuit are configured as hardware circuits, i.e., a fixed configuration of hardware circuits (gates, multiplexers, etc.).

[0194] The erroneous bits (i.e. the erroneous bit positions) of the message word are determined based on the error locator polynomial associated with the BCH code. The erroneous bits are given by the logarithm of the zeros of the error locator polynomial. Here, too, a mirrored version of the error locator polynomial is used, in which the order of the coefficients is swapped (the leading coefficient of the error locator polynomial becomes a constant coefficient in the mirrored version, the coefficients following the leading coefficient become linear coefficients in the mirrored version, etc.): The zeros of the mirrored error locator polynomial are the inverse of the zeros of the error locator polynomial and thus the logarithm of the zeros of the mirrored error locator polynomial differs from the logarithm of the zeros of the error locator polynomial only by the sign.

[0195] refer to Figure 3The described integrated circuit can be used in combination with a memory, in particular a non-volatile memory, as described above. However, it can also be used, for example, to communicate via a communication channel (wireless or wired) in order to achieve: correction of transmission errors. In this case, the circuit 103 is, for example, arranged in a transmitting / receiving device.

[0196] According to different embodiments, one or more of the following features are provided to implement a hardware implementation of a BCH decoder:

[0197] Explicit calculation and tabulation of the zeros of the error locator polynomial (of the rational transformation): Since the polynomial after the transformation is only dependent on the values ​​calculated from the syndrome elements, the size of the required table grows only with O(n log(n)). At the same time, many additionally required operations on the field elements can be incorporated into the precomputed table.

[0198] · Taking the logarithm of the equation for the zeros of the error locating polynomial: By early calculation of the logarithms a=dlog(s1), b=dlog(s3) and c=dlog(s5) from the correction sub-elements s1, s2 and s3 (as long as the said elements exist in the code used), it is possible to convert the relatively complex multiplications and divisions in the limited extension field of the vector space expression into simpler modular additions and subtractions in the discrete logarithm expression.

[0199] Use of mirrored error locator polynomials: By mirroring the error locator polynomials, the required rational functions for transforming the "mirrored" cubic error locator polynomials associated with the syndrome element values ​​in the case of 3-bit errors can be significantly simplified. The transformation is a rational transformation, i.e. substitutions are made with rational terms.

[0200] Figure 4 A flow chart 400 is shown which illustrates a method for processing an encoded message word.

[0201] In 401 a message word is received.

[0202] In 402, a message word is calculated according to a preset BCH code, wherein the syndrome has one or more syndrome elements in an extended field of a prime field.

[0203] At 403, the logarithm of each of the one or more syndrome elements is calculated.

[0204] At 404, the logarithm of each of the one or more zeros of the error locator polynomial of the BCH code is found based on the logarithm of the one or more syndrome elements.

[0205] At 405 , a message word, whose bits are described by the logarithm of one or more zeros of the error locator polynomial, is inverted.

[0206] Processing of the message word (corrected according to 405 ) is continued at 406 .

[0207] Next, embodiments are described.

[0208] Example 1 is as follows Figure 3 The integrated circuit shown in FIG.

[0209] Embodiment 2 is an integrated circuit according to embodiment 1, wherein the receiver has a memory interface and is designed to read the message word from the memory.

[0210] Embodiment 3 is an integrated circuit according to embodiment 2, wherein the data processing circuit is configured to store the message word processed by the bit inverter circuit in the memory again.

[0211] Embodiment 4 is the integrated circuit according to embodiment 2 or 3, wherein the memory is a non-volatile memory.

[0212] Embodiment 5 is an integrated circuit according to any one of embodiments 1 to 4, wherein the logarithm of the one or more syndrome elements is the logarithm of the syndrome element based on the extended range primitive element.

[0213] Embodiment 6 is an integrated circuit according to embodiment 5, wherein the logarithm operator is configured to calculate the logarithm by looking up in a pre-calculated logarithm table.

[0214] Embodiment 7 is an integrated circuit according to embodiment 6, wherein the pre-computed table has a size of O(n log n), where n is the length of the BCH code.

[0215] Embodiment 8 is an integrated circuit according to any one of embodiments 1 to 7, wherein the arithmetic operation circuit is designed to: avoid extended-range arithmetic operations, so as to achieve efficient hardware execution.

[0216] Embodiment 9 is an integrated circuit according to any one of embodiments 1 to 8, wherein the hardware decoding circuit is designed to: operate without a programmable processor.

[0217] Embodiment 10 is an integrated circuit according to one of embodiments 1 to 9, wherein the hardware decoding circuit is hard-wired.

[0218] Embodiment 11 is an integrated circuit according to one of embodiments 1 to 10, wherein the prime field is GF(2).

[0219] Embodiment 12 is an integrated circuit according to any one of embodiments 1 to 11, wherein the arithmetic operation circuit is configured to: determine the logarithm of the zero point of the error locator polynomial based on a mirror version of the error locator polynomial.

[0220] Embodiment 13 is an integrated circuit according to one of embodiments 1 to 12, wherein the arithmetic operation circuit is designed to: calculate the logarithm of the zero point of the error locator polynomial based on a mirror version of the error locator polynomial transformed according to a rational transformation, and the coefficients of the version are independent of the syndrome elements except for the constant coefficients.

[0221] Embodiment 14 is an integrated circuit according to one of embodiments 1 to 13, wherein the arithmetic operation circuit is designed to: find the logarithm of the zero point of the error locator polynomial by looking it up in a pre-calculated zero point table, wherein the zero point table contains information about the logarithm of the zero point of the error locator polynomial associated with the constant coefficients of the transformed mirror version of the error locator polynomial.

[0222] Example 15 is as follows Figure 4 The method for processing encoded message words is shown in .

[0223] Embodiment 16 is a method according to embodiment 15, having: reading the message word from the memory.

[0224] Embodiment 17 is a method according to embodiment 16, which has the feature of storing the message word processed by inverting the bits in the memory again.

[0225] Embodiment 18 is a method according to embodiment 16 or 17, wherein the memory is a non-volatile memory.

[0226] Embodiment 19 is a method according to any one of embodiments 15 to 18, wherein the logarithm of one or more syndrome elements is the logarithm of the syndrome element with the base primitive of the extended domain.

[0227] Embodiment 20 is a method according to embodiment 19, having the following features: finding the logarithm by looking up in a pre-computed table of logarithms.

[0228] Embodiment 21 is a method according to embodiment 20, wherein the pre-computed table has a size of O(n log n), where n is the length of the BCH code.

[0229] Embodiment 22 is a method according to one of embodiments 15 to 21, wherein: extended-range arithmetic operations are avoided to achieve efficient hardware execution.

[0230] Embodiment 23 is a method according to one of embodiments 15 to 22, comprising: performing a syndrome calculation without a programmable processor, finding the logarithm of each of the one or more syndrome elements, finding the logarithm of each of the one or more zeros of the error locator polynomial of the BCH code; and inverting the bits of the message word.

[0231] Embodiment 24 is a method according to one of embodiments 15 to 23, comprising: performing a syndrome calculation by means of a hard-wired hardware decoding circuit, finding the logarithm of each of the one or more syndrome elements, finding the logarithm of each of the one or more zeros of the error locator polynomial of the BCH code; and inverting the bits of the message word.

[0232] Embodiment 25 is a method according to one of embodiments 15 to 24, wherein the prime domain is GF(2).

[0233] Embodiment 26 is a method according to one of embodiments 15 to 25, which has the following features: the logarithm of the zero point of the error locator polynomial is calculated based on the mirror version of the error locator polynomial.

[0234] Embodiment 27 is a method according to one of embodiments 15 to 26, which has the following features: finding the logarithm of the zero point of the error locator polynomial based on a mirror version of the error locator polynomial transformed according to a rational transformation, wherein the coefficients of the version are independent of the correction sub-element except for the constant coefficients.

[0235] Embodiment 28 is a method according to one of embodiments 15 to 27, which has the following features: finding the logarithm of the zero point of the error locator polynomial by looking it up in a pre-calculated zero point table, wherein the zero point table contains information about the logarithm of the zero point of the error locator polynomial associated with the constant coefficients of the transformed mirror version of the error locator polynomial.

[0236] Embodiment 29 is a device for processing an encoded message word, the device comprising: a mechanism for receiving a message; a mechanism for calculating a syndrome of the message word based on a preset BCH code, wherein the syndrome has one or more syndrome elements in an extended field of a prime field; a mechanism for finding the logarithm of each of the one or more syndrome elements; a mechanism for finding the logarithm of each of the one or more zero points of an error locator polynomial of the BCH code based on the logarithm of the one or more syndrome elements; a mechanism for inverting bits of the message word, the positions of the bits being described by the logarithm of the one or more zero points of the error locator polynomial; and a mechanism for continuing to process the message word.

[0237] Embodiment 30 is a device according to embodiment 29, having a mechanism for reading the message word from the memory.

[0238] Embodiment 31 is a device according to embodiment 30, which has a mechanism for storing the message word processed by inverting the bits again in the memory.

[0239] Embodiment 32 is a device according to embodiment 30 or 31, wherein the memory is a non-volatile memory.

[0240] Embodiment 33 is a device according to any one of embodiments 29 to 32, wherein the logarithm of one or more syndrome elements is the logarithm of the syndrome element with the base being the primitive element of the extended domain.

[0241] Embodiment 34 is a device according to embodiment 33, wherein the mechanism for finding the logarithm is used to find the logarithm by looking up in a pre-calculated table of logarithms.

[0242] Embodiment 35 is a device according to embodiment 34, wherein the pre-computed table has a size of O(n log n), where n is the length of the BCH code.

[0243] Embodiment 36 is a device according to one of embodiments 29 to 35, wherein a mechanism for receiving a message word, a mechanism for calculating a syndrome of the message word, a mechanism for finding the logarithm of each syndrome element in one or more syndrome elements, a mechanism for finding the logarithm of each zero point in one or more zero points of an error locator polynomial, a mechanism for inverting bits of the message word, and a mechanism for further processing avoid extended-domain arithmetic operations, so that efficient hardware execution is achieved.

[0244] Embodiment 37 is a device according to one of embodiments 29 to 36, which has a mechanism for receiving a message word, a mechanism for calculating a syndrome of the message word, a mechanism for finding the logarithm of each of one or more syndrome elements, a mechanism for finding the logarithm of each of one or more zero points of an error locator polynomial, a mechanism for inverting bits of the message word, and a mechanism for further processing, and operates without a programmable processor.

[0245] Embodiment 38 is a device according to one of embodiments 29 to 37, which has a means for receiving a message word, a means for calculating a syndrome of the message word, a means for finding the logarithm of each syndrome element in one or more syndrome elements, a means for finding the logarithm of each zero point in one or more zero points of an error locator polynomial, a means for inverting bits of the message word and a means for further processing, which operates with the aid of a hard-wired hardware decoding circuit.

[0246] Embodiment 39 is a device according to one of embodiments 29 to 38, wherein the prime field is GF(2).

[0247] Embodiment 40 is a device according to one of embodiments 29 to 39, wherein the mechanism for determining the logarithm of the zero point of the error locator polynomial operates based on a mirror version of the error locator polynomial.

[0248] Embodiment 41 is a device according to one of embodiments 29 to 40, wherein the mechanism for finding the logarithm of the zero point of the error locator polynomial operates based on a mirror version of the error locator polynomial transformed according to a rational transformation, the coefficients of which are independent of the syndrome elements except for constant coefficients.

[0249] Embodiment 42 is a device according to one of embodiments 29 to 41, wherein the mechanism for finding the logarithm of the zero point of the error locator polynomial finds the logarithm of the zero point of the error locator polynomial by looking it up in a pre-calculated zero point table, wherein the zero point table contains information about the logarithm of the zero point of the error locator polynomial associated with the constant coefficients of the transformed mirror version of the error locator polynomial.

[0250] Although the present invention is shown and described primarily with reference to specific embodiments, it will be appreciated by those skilled in the art that many changes may be made in design and detail without departing from the spirit and scope of the present invention as defined by the claims. Therefore, the scope of the present invention is determined by the appended claims, and is intended to cover all changes that fall within the meaning or equivalent scope of the claims.

[0251] Reference numerals list

[0252] 100 Safety circuit

[0253] 101 Non-volatile Memory

[0254] 102 Microprocessor

[0255] 103 Hardware Circuit

[0256] 104 Encoder

[0257] 105 Decoder

[0258] 200 Encoder-Decoder Circuit

[0259] 201 XOR Gate

[0260] 202 AND gate (UND)

[0261] 203 Multiplier

[0262] 204 Registers

[0263] 205 XOR Gate

[0264] 206 Multiplier

[0265] 207 Multiplier

[0266] 208 Registers

[0267] 209 Multiplexer

[0268] 210 Control device

[0269] 211 Table

[0270] 212 Registers

[0271] 213 Multiplexer

[0272] 214 Subtractor

[0273] 215 Registers

[0274] 216 Multiplexer

[0275] 300 Integrated Circuits

[0276] 301 Receiver

[0277] 302 Decoding Circuit

[0278] 303 Computational Unit

[0279] 304 Logarithm operator

[0280] 305 Arithmetic Operation Circuit

[0281] 306 bit inverter circuit

[0282] 307 Data Processing Circuit

[0283] 400 Flowchart

[0284] 401-406 Methods and Steps

Claims

1. An integrated circuit, comprising: a receiver, designed to receive the message word; An integrated hardware decoding circuit, the hardware decoding circuit having: A calculation unit, wherein the calculation unit is configured to calculate a syndrome of a message word according to a preset Bose-Chaudhuri-Hokkewenheim code, i.e., a BCH code, wherein the syndrome has one or more syndrome elements in an extended field of a prime field; a logarithm operator configured to calculate a logarithm of each syndrome element of the one or more syndrome elements; an arithmetic operation circuit, the arithmetic operation circuit being configured to obtain the logarithm of each of the one or more zero points of the error locator polynomial of the BCH code based on the logarithm of the one or more syndrome elements; a bit inverter circuit, the bit inverter circuit being designed to invert one or more bits of the message word, the position of the bits being described by the logarithm of the one or more zero points of the error locator polynomial, a data processing circuit designed to store the message words processed by the bit inverter circuit; The arithmetic operation circuit is further configured to: calculate the logarithm of each of the one or more zero points of the error locator polynomial based on a mirror version of the error locator polynomial.

2. The integrated circuit of claim 1, wherein the receiver has a memory interface and is designed to read the message word from a memory.

3. The integrated circuit of claim 2, wherein the data processing circuit is designed to store the message word processed by the bit inverter circuit in the memory.

4. The integrated circuit of claim 2, wherein the memory is a non-volatile memory. 5 . The integrated circuit of claim 1 , wherein the logarithm of the one or more syndrome elements is the logarithm of the syndrome element with respect to a primitive element of the extended domain.

6. The integrated circuit of claim 5, wherein the logarithm operator is configured to calculate the logarithm by looking up in a pre-calculated logarithm table.

7. The integrated circuit of claim 6, wherein the pre-computed table has a size of O(nlog n), where n is the length of the BCH code.

8. The integrated circuit according to claim 1, wherein the arithmetic operation circuit is designed to avoid the extended-range arithmetic operation so as to be performed with efficient hardware.

9. The integrated circuit of claim 1, wherein the hardware decoding circuit is designed to operate without a programmable processor.

10. The integrated circuit of claim 1, wherein the hardware decoding circuit is hardwired.

11. The integrated circuit of claim 1, wherein the prime field is GF(2).

12. The integrated circuit of claim 1 , wherein the arithmetic operation circuit is configured to find the logarithm of each of the one or more zeros of the error locator polynomial based on a transformed version of the mirrored version of the error locator polynomial according to a rational transformation, the coefficients of the error locator polynomial being independent of the one or more syndrome elements except for constant coefficients.

13. An integrated circuit according to claim 12, wherein the arithmetic operation circuit is designed to: find the logarithm of each of the one or more zeros of the error locator polynomial by looking it up in a pre-computed zero table, the zero table containing information about the logarithms of the zeros of the error locator polynomial associated with constant coefficients of a transformed mirror version of the error locator polynomial.

14. The integrated circuit of claim 13 , wherein the arithmetic operation circuit is configured to: find the logarithm of at least one zero point of the error locator polynomial by looking it up in a pre-calculated zero point table, and based on information about the logarithm of the at least one zero point found by looking it up in the pre-calculated zero point table, calculate the logarithm of each of the one or more zero points of the error locator polynomial that are different from the at least one zero point of the error locator polynomial whose logarithm is found by looking it up in the pre-calculated zero point table.

15. The integrated circuit of claim 1, wherein calculating the syndrome of the message word according to the preset BCH code comprises: A generator polynomial of a preset BCH code is determined by selecting a minimum polynomial of powers of primitive elements of an extended domain, and a least common multiple of the determined minimum polynomial is determined, wherein the minimum polynomial is selected so that the weight of a matrix used for calculating a remainder of a polynomial division of a polynomial associated with a message word and the generator polynomial is minimized.

16. A method for processing an encoded message word, the method comprising: Receive message word; Calculating a syndrome of the message word according to a preset Bose-Chaudhuri-Hokkewenheim BCH code, i.e., a BCH code, wherein the syndrome has at least one or more syndrome elements in an extended field of a prime field; finding the logarithm of each of the one or more syndrome elements; Calculating the logarithm of each of the one or more zeros of the error locator polynomial of the BCH code based on the logarithm of the one or more syndrome elements; inverting bits of the message word, the positions of the bits being described by the logarithm of the one or more zeros of the error locator polynomial; Continue processing the message word, Wherein the logarithm of each of the one or more zero points of the error locator polynomial is obtained based on a mirror version of the error locator polynomial.

17. The method of claim 16, wherein the logarithm of the one or more syndrome elements is the logarithm of the syndrome element with respect to a primitive element of the extended domain.

18. The method of claim 16, wherein the logarithm is found by looking up in a pre-computed table of logarithms.

19. The method of claim 18, wherein the pre-computed table has a size of O(nlog n), where n is the length of the BCH code.

20. The method of claim 16, wherein the prime domain is GF(2).

21. The method of claim 16, wherein the logarithm of each of the one or more zeros of the error locator polynomial is found based on the mirrored version of the error locator polynomial.

Images