Codes

Why Errors Need Detecting#

In Cryptosystems the whole point was privacy; we wanted a message that an eavesdropper could not read. Sometimes we are much less worried about privacy and much more worried about the message arriving intact. Wires pick up noise, discs get scratched, satellites get hit by cosmic rays; digits flip. What we want is a way of writing the message down so that a flipped digit is at least noticeable, and ideally repairable.

To see why this is a genuine problem, take the standard letter-to-number conversion $A \to 1$, $B \to 2$, $C \to 3, \dots$ and send the letter $M$. Then $M \to 13$, and (recalling Base Number Systems) $13$ in binary is

$$13 = 8 + 4 + 1 = (1101)_2,$$

so we transmit the string $1101$. Now suppose the leading digit gets knocked from $1$ to $0$ in transit, so the receiver sees $0101$. They decode this perfectly happily:

$$(0101)_2 = 4 + 1 = 5 \to E.$$

The receiver reads $E$, believes it, and has absolutely no reason to suspect anything went wrong. This is the failure mode we are trying to design away. The problem is not that an error occurred; the problem is that every one of the sixteen $4$-digit strings is a legal message, so a corrupted string is still a legal message.

The fix, in every code in this lecture, is the same idea: deliberately send more digits than the message needs, arranged so that only some of the strings are legal. Then a single flip drops you off the list of legal strings and the receiver can see it. Codes come in two strengths:

• an error-detecting code lets the receiver tell that something has gone wrong (so they can ask for a retransmission);
• an error-correcting code lets the receiver work out which digit is wrong and repair it without asking for anything.

All the arithmetic in this lecture happens in $\mathbb{Z}_2 = \{0, 1\}$, which by Rings and Fields is a field, and in which the only rules you need are

$$0 + 0 = 0, \quad 0 + 1 = 1 + 0 = 1, \quad 1 + 1 = 0.$$

Basically, addition in $\mathbb{Z}_2$ is "flip the digit if you add $1$, leave it alone if you add $0$", and it is its own inverse: $-1 = 1$, so in $\mathbb{Z}_2$ there is no difference between adding and subtracting, and you never have to worry about signs. That single fact makes every calculation below shorter than it looks.

Parity Check Codes#

The cheapest possible thing you can do is add one extra digit that records whether the message had an even or odd number of $1$s.

Basically, the check digit is chosen to make the total number of $1$s even; so if the receiver ever counts an odd number of $1$s, a digit must have flipped. Said in $\mathbb{Z}_2$, if the message digits are $m_1, m_2, \dots, m_k$ then the check digit is simply

$$m_{k+1} = m_1 + m_2 + \cdots + m_k \text{ in } \mathbb{Z}_2,$$

and a legal encoded word is exactly one satisfying $m_1 + m_2 + \cdots + m_k + m_{k+1} = 0$ in $\mathbb{Z}_2$. Keep that phrasing in mind; every code in this lecture will turn out to be "the strings satisfying some system of $\mathbb{Z}_2$ equations".

Example. Encode the letter $M$ with a simple parity check, and show what happens when the leading digit is flipped in transit.
As above, $M \to 13 \to 1101$. The original message $1101$ contains three $1$s, which is odd, so the check digit is $1$ and the transmitted word is

$$11011.$$

Suppose the leading digit is flipped, so the receiver gets $01011$. Counting,

$$\begin{align*} 0 + 1 + 0 + 1 + 1 &= 3, \end{align*}$$

which is odd; therefore the receiver knows that at least one error has occurred and can request a retransmission. Contrast this with the bare $4$-digit code, where the same flip silently turned $M$ into $E$; one extra digit bought us the ability to notice.

Example. The same word $11011$ is sent, but this time the first two digits are flipped, so the receiver gets $00011$. What happens?
Counting the $1$s,

$$\begin{align*} 0 + 0 + 0 + 1 + 1 &= 2, \end{align*}$$

which is even, so the parity check passes and the receiver suspects nothing. They discard the final digit and read $0001 = 1 \to A$. Therefore, the parity check completely misses this pair of errors and silently reports the letter $A$ instead of $M$. A parity check detects exactly an odd number of errors; any even number of errors cancels out and slips through unnoticed.

It is worth being blunt about the other limitation as well. Even when the check does fire, all it tells you is "somewhere in these five digits, an odd number of things are wrong". It does not tell you where, and it does not tell you how many, so there is nothing you can do except ask for the message again. The simple parity check is a pure error-detecting code; it can never correct anything.

The cost of the code is one extra digit per chunk. If we parity-check in chunks of $4$ information digits, then $5$ digits get transmitted for every $4$ digits of actual message, so $\tfrac45$ of the traffic is useful; we will call this proportion the rate of the code. A rate of $\tfrac45$ is excellent value, which is precisely why parity bits are everywhere in real hardware. The trouble is that we got what we paid for: cheap code, weak guarantees.

Reduplication Codes#

The obvious way to buy more protection is brute force; just say everything twice.

Basically, the legal pairs are $00$ and $11$; anything else is a red flag, and it even tells you which pair went wrong. This is strictly better than a parity check in one respect and strictly worse in another, so it is worth being careful about exactly what it gives you.

Example. Encode $M \to 1101$ under double reduplication, and decode the received word $11100011$.
Repeating each digit twice, the transmitted word is

$$1101 \longrightarrow 11\ 11\ 00\ 11.$$

The receiver gets $11\ 10\ 00\ 11$. Splitting into pairs and reading them off,

$$\begin{align*} 11 &\to 1, \\ 10 &\to \text{error in this position}, \\ 00 &\to 0, \\ 11 &\to 1. \end{align*}$$

Therefore, the receiver knows that an error occurred, and knows it happened in the second digit of the message — but that is as far as it goes. The true second digit could have been a $1$ (with the second copy flipped) or a $0$ (with the first copy flipped), and nothing in the received word distinguishes those two stories. Double reduplication detects and locates an error, but it still cannot correct one.

Notice also that multiple errors are often, but not always, caught: two errors in different pairs both show up, whereas two errors inside the same pair turn $11$ back into $00$ and are invisible. In exchange for all this we have doubled the length of the message, so the rate has crashed from $\tfrac45$ to $\tfrac12$. That is a lot of bandwidth for a code that still cannot fix anything.

If saying everything twice does not let you correct, the natural next move is to say everything three times and take a vote.

Basically, this is majority rule: each digit gets three votes, and the minority is assumed to be the mistake. The correction is only valid under the assumption that there is at most one error per triple; if two digits inside the same triple flip, the majority vote confidently returns the wrong answer, which is worse than not correcting at all.

Example. Encode $M \to 1101$ under triple reduplication, and decode the received word $111\ 101\ 000\ 011$.
Repeating each digit three times, the transmitted word is

$$1101 \longrightarrow 111\ 111\ 000\ 111,$$

which is $12$ digits long. Splitting the received word into triples and taking a majority vote in each,

$$\begin{align*} 111 &\to 1 \quad (\text{unanimous}), \\ 101 &\to 1 \quad (\text{two } 1\text{s, so the middle digit was flipped}), \\ 000 &\to 0 \quad (\text{unanimous}), \\ 011 &\to 1 \quad (\text{two } 1\text{s, so the first digit was flipped}). \end{align*}$$

Therefore, the decoded message is $1101 = 13 \to M$, recovered correctly despite two transmission errors, and the receiver can even point at exactly which two digits were wrong. This is a genuine error-correcting code.

Example. Under the same code, what does the receiver make of the received triple $110$?
Majority vote gives $1$, since two of the three digits are $1$. If exactly one error occurred, this is right. But if the sent triple was $000$ and two digits flipped, the true digit was $0$ and the decoder has just committed confidently to the wrong value; and if the sent triple was $111$ with one flip, it is right. Therefore, the answer the code returns is $1$, but that answer is only trustworthy under the at-most-one-error-per-triple assumption. Every error-correcting code in this course carries an assumption of that kind; quoting the answer without quoting the assumption is only half the answer.

The price is brutal: the rate has fallen to $\tfrac13$, so two out of every three digits you transmit are pure redundancy, and all of that only buys you one correctable error per three digits. Compare the three codes so far:

The obvious question is whether we can get the correcting power of the third row at anything like the rate of the first. The answer is yes, and it comes from linear algebra.

Vectors and Matrices#

Before building the good codes, we need a little machinery. Nothing here is deep; it is just a compact language for saying "this collection of digits satisfies this collection of $\mathbb{Z}_2$ equations".

Sizes are always quoted as (rows) $\times$ (columns), in that order; getting this backwards is the single most common slip in matrix questions, and it makes every subsequent product illegal.

The transpose is mostly a typographical convenience here: our codewords are naturally written left-to-right as row vectors, but matrices multiply column vectors, so $x^T$ is how a codeword $x$ gets fed into a matrix.

Multiplication is defined by "row against column". The product of a $1 \times k$ row vector $u$ with a $k \times 1$ column vector $v$ is the single number

$$uv = (u_1, u_2, \dots, u_k)(v_1, v_2, \dots, v_k)^T = \sum_{i=1}^{k} u_i v_i = u_1v_1 + u_2v_2 + \cdots + u_kv_k,$$

and to multiply two matrices $A$ and $B$ we create a new matrix $AB$ whose $(i,j)$th entry is the product of the $i$th row of $A$ with the $j$th column of $B$. The case we actually use is a matrix times a column vector: the product of an $a \times b$ matrix $M$ with a $b \times 1$ column vector $v$ is an $a \times 1$ vector $Mv$ whose $k$th entry is $\sum_{i=1}^{b} m_{k,i}v_i$. Written out for a $2 \times 3$ matrix,

$$\begin{pmatrix} m_{1,1} & m_{1,2} & m_{1,3} \\ m_{2,1} & m_{2,2} & m_{2,3} \end{pmatrix} \begin{pmatrix} v_1 \\ v_2 \\ v_3 \end{pmatrix} = \begin{pmatrix} m_{1,1}v_1 + m_{1,2}v_2 + m_{1,3}v_3 \\ m_{2,1}v_1 + m_{2,2}v_2 + m_{2,3}v_3 \end{pmatrix}.$$

Basically, each row of the matrix eats the whole vector and produces one number, so the answer has as many entries as $M$ has rows.

Example. What is the product of $\begin{pmatrix} 1 & 2 & 3 \\ 4 & 2 & 0 \end{pmatrix}$ and $(1,3,2)^T$?
This is a $2 \times 3$ matrix times a $3 \times 1$ column vector, so the answer is $2 \times 1$. Taking each row against the column in turn,

$$\begin{align*} \begin{pmatrix} 1 & 2 & 3 \\ 4 & 2 & 0 \end{pmatrix} \begin{pmatrix} 1 \\ 3 \\ 2 \end{pmatrix} &= \begin{pmatrix} 1(1) + 2(3) + 3(2) \\ 4(1) + 2(3) + 0(2) \end{pmatrix} \\ &= \begin{pmatrix} 1 + 6 + 6 \\ 4 + 6 + 0 \end{pmatrix} \\ &= \begin{pmatrix} 13 \\ 10 \end{pmatrix}. \end{align*}$$

Therefore, the product is $(13, 10)^T$.

For codes we do exactly this arithmetic but in $\mathbb{Z}_2$, which is much easier: every entry of the matrix is $0$ or $1$, so a row against a column is just "add up the entries of the vector sitting underneath a $1$, then reduce mod $2$". In other words, the $k$th entry of $Mv$ over $\mathbb{Z}_2$ is $0$ if the positions where row $k$ has a $1$ contain an even number of $1$s in $v$, and $1$ if they contain an odd number. Every Hamming calculation below is really a stack of parity checks in disguise.

Example. Compute $Mv$ over $\mathbb{Z}_2$, where $M = \begin{pmatrix} 1 & 0 & 1 & 1 \\ 0 & 1 & 1 & 0 \\ 1 & 1 & 0 & 1 \end{pmatrix}$ and $v = (1,1,0,1)^T$.
Reading off which positions of $v$ each row selects,

$$\begin{align*} \text{row } 1 &: v_1 + v_3 + v_4 = 1 + 0 + 1 = 0, \\ \text{row } 2 &: v_2 + v_3 = 1 + 0 = 1, \\ \text{row } 3 &: v_1 + v_2 + v_4 = 1 + 1 + 1 = 1, \end{align*}$$

all in $\mathbb{Z}_2$. Therefore, $Mv = (0,1,1)^T$. Notice that no multiplication was ever performed; over $\mathbb{Z}_2$ you only ever count $1$s and ask whether the count is even or odd.

The Hamming (7,4) Code#

A Hamming code is a very efficient type of error-correcting code, in the sense that it minimises the number of check digits required per message while maximising the number of errors that can be detected or corrected. The smallest useful one squeezes $4$ information digits into $7$ transmitted digits, so it corrects a single error at a rate of $\tfrac47$ — compare that with triple reduplication, which needs $12$ digits to protect the same $4$.

Everything is controlled by one matrix.

That last sentence is the whole trick, so make sure you can see it. Reading each column upwards gives a $3$-digit binary string, and those strings run through $1, 2, \dots, 7$ in order:

The columns are written bottom-to-top, not top-to-bottom; if you read them the wrong way round every position you report will be the bit-reversal of the truth. A quick way to remember it: the top row is the $1$s bit, the middle row is the $2$s bit, the bottom row is the $4$s bit — the same order as an ordinary binary expansion once you turn your head sideways.

Notice that the columns in positions $1, 2$ and $4$ are exactly the standard basis vectors $e_1, e_2, e_3$. Those are the positions that will hold the check digits, and it is no accident; a check digit whose column is $e_j$ appears in the $j$th equation and no other, so each check digit can be solved for on its own.

Encoding#

Basically, the information digits $a,b,c,d$ are dropped into positions $3, 5, 6, 7$ untouched, and the three check digits at positions $1, 2, 4$ are each a parity check over a carefully chosen subset of them. The rule is not arbitrary; each check digit exists to make one row of $H$ sum to zero. Reading the equation $Hx^T = 0$ row by row with $x_3 = a$, $x_5 = b$, $x_6 = c$, $x_7 = d$,

$$\begin{align*} \text{row } 1 &: x_1 + x_3 + x_5 + x_7 = 0 &&\implies x_1 = a + b + d, \\ \text{row } 2 &: x_2 + x_3 + x_6 + x_7 = 0 &&\implies x_2 = a + c + d, \\ \text{row } 3 &: x_4 + x_5 + x_6 + x_7 = 0 &&\implies x_4 = b + c + d, \end{align*}$$

where we used that $-1 = 1$ in $\mathbb{Z}_2$ so moving a term across the equals sign changes nothing. That derivation is worth internalising, because it is exactly what you repeat when the matrix changes.

Example. Using the standard Hamming $(7,4)$ code, encode the message $(1,1,0,1)$.
Here $a = 1$, $b = 1$, $c = 0$, $d = 1$, so the three check digits are

$$\begin{align*} a + b + d &= 1 + 1 + 1 \\ &= 1, \\ a + c + d &= 1 + 0 + 1 \\ &= 0, \\ b + c + d &= 1 + 0 + 1 \\ &= 0, \end{align*}$$

all in $\mathbb{Z}_2$. Slotting these into positions $1, 2, 4$ and the information digits into positions $3, 5, 6, 7$,

$$x = (1,\ 0,\ 1,\ 0,\ 1,\ 0,\ 1).$$

As a check, $Hx^T$ should be the zero vector; row $1$ selects positions $1,3,5,7$ giving $1+1+1+1 = 0$, row $2$ selects positions $2,3,6,7$ giving $0+1+0+1 = 0$, and row $3$ selects positions $4,5,6,7$ giving $0+1+0+1 = 0$. Therefore, the encoded message is $(1,0,1,0,1,0,1)$, and it is a legal codeword.

Example. Using the standard Hamming $(7,4)$ code, encode the message $(1,0,1,0)$.
Now $a = 1$, $b = 0$, $c = 1$, $d = 0$, so

$$\begin{align*} a + b + d &= 1 + 0 + 0 = 1, \\ a + c + d &= 1 + 1 + 0 = 0, \\ b + c + d &= 0 + 1 + 0 = 1, \end{align*}$$

in $\mathbb{Z}_2$. Therefore, the encoded message is $(1, 0, 1, 1, 0, 1, 0)$. Checking against $H$ once more: positions $1,3,5,7$ give $1+1+0+0 = 0$; positions $2,3,6,7$ give $0+1+1+0 = 0$; positions $4,5,6,7$ give $1+0+1+0 = 0$, so $Hx^T = 0$ as required. Always run this check; it costs three additions and catches every arithmetic slip you could have made in the encoding.

Decoding#

Basically, $z$ is a three-digit binary number that is the position of the broken digit, spelled out bottom-to-top. That is why the columns of $H$ were arranged in counting order in the first place; the matrix is designed so that the error announces its own address.

Example. Using the standard Hamming $(7,4)$ code, decode the received message $(1,0,1,1,0,0,1)$, assuming there is at most one error.
Write $y = (1,0,1,1,0,0,1)$ and compute $z = Hy^T$ one row at a time, remembering that each row just adds up the entries of $y$ in the positions where that row of $H$ has a $1$:

$$\begin{align*} z_1 &= y_1 + y_3 + y_5 + y_7 \\ &= 1 + 1 + 0 + 1 \\ &= 1, \\ z_2 &= y_2 + y_3 + y_6 + y_7 \\ &= 0 + 1 + 0 + 1 \\ &= 0, \\ z_3 &= y_4 + y_5 + y_6 + y_7 \\ &= 1 + 0 + 0 + 1 \\ &= 0, \end{align*}$$

all in $\mathbb{Z}_2$, so

$$z = \begin{pmatrix} 1 \\ 0 \\ 0 \end{pmatrix} \neq 0.$$

Since $z \neq 0$ there is an error, and $z = (1,0,0)^T$ is the first column of $H$; equivalently, reading $z$ from bottom to top gives $001 = 1$. So the error is in position $1$. Flipping that digit gives the corrected codeword

$$(0, 0, 1, 1, 0, 0, 1),$$

and extracting positions $3, 5, 6, 7$ gives the message digits $(1, 0, 0, 1)$. Therefore, the decoded message is $(1,0,0,1)$. As a sanity check, encoding $(1,0,0,1)$ gives check digits $a+b+d = 1+0+1 = 0$, $a+c+d = 1+0+1 = 0$ and $b+c+d = 0+0+1 = 1$, i.e. the codeword $(0,0,1,1,0,0,1)$ — exactly the corrected word, so everything is consistent.

Example. Assuming there is at most one error, decode $(1,1,0,1,0,1,1)$ using the standard Hamming $(7,4)$ code.
Computing $z = Hy^T$ over $\mathbb{Z}_2$,

$$\begin{align*} z_1 &= y_1 + y_3 + y_5 + y_7 = 1 + 0 + 0 + 1 = 0, \\ z_2 &= y_2 + y_3 + y_6 + y_7 = 1 + 0 + 1 + 1 = 1, \\ z_3 &= y_4 + y_5 + y_6 + y_7 = 1 + 0 + 1 + 1 = 1, \end{align*}$$

so $z = (0,1,1)^T$. Reading bottom to top, $110 = 6$, and indeed $(0,1,1)^T$ is the sixth column of $H$; the error is in position $6$. Flipping it gives $(1,1,0,1,0,0,1)$, whose digits in positions $3,5,6,7$ are $(0,0,0,1)$. Therefore, the decoded message is $(0,0,0,1)$. Checking: encoding $(0,0,0,1)$ gives $a+b+d = 1$, $a+c+d = 1$, $b+c+d = 1$, i.e. $(1,1,0,1,0,0,1)$, which matches.

Example. Assuming there is at most one error, decode $(1,0,1,0,1,0,1)$.
Computing the three parities,

$$\begin{align*} z_1 &= 1 + 1 + 1 + 1 = 0, \\ z_2 &= 0 + 1 + 0 + 1 = 0, \\ z_3 &= 0 + 1 + 0 + 1 = 0, \end{align*}$$

so $z = 0$. Therefore, no error occurred, and the message is read straight off positions $3,5,6,7$ as $(1,1,0,1)$ — which is exactly the message we encoded in the first example of this section, as it should be. When $z = 0$ you do not "correct" anything; you read the message off the received word unchanged.

Non-Standard Hamming Codes#

Why does the decoding rule work at all? The argument is short and it is the most important paragraph in the lecture, because it tells you exactly how much freedom you have in choosing $H$.

Suppose a single error occurs at position $i$. Over $\mathbb{Z}_2$, flipping the $i$th digit is the same as adding $1$ to it, so the received word $y$ is related to the sent word $x$ by

$$y^T = x^T + e_i \text{ over } \mathbb{Z}_2,$$

where $e_i$ is the $i$th standard basis vector. Then, using that matrix multiplication distributes over addition and that $Hx^T = 0$ for every codeword,

$$\begin{align*} Hy^T &= H(x^T + e_i) \\ &= Hx^T + He_i \\ &= 0 + He_i \\ &= He_i, \end{align*}$$

and $He_i$ is precisely the $i$th column of $H$ (multiplying by $e_i$ picks out column $i$ and kills everything else). So:

$$\boxed{z = Hy^T \text{ is exactly the column of } H \text{ sitting at the position of the error.}}$$

Basically, the syndrome $z$ does not know or care what the message was; it only sees the error. And notice what the argument never used: it never used the fact that the columns of $H$ were the numbers $1$ through $7$ in order. All it needs is that the columns are distinct and nonzero, so that "the column matching $z$" picks out a unique position.

This tells us that the decoding method will work regardless of the matrix $H$ used, implying that variations of the standard Hamming $(7,4)$ code exist where a different matrix $H'$ uses some permutation of the original columns. With such an $H'$ we still calculate $z = H'y^T$, and (assuming at most one error) if $z = 0$ then there are no errors, while otherwise there is one error at the position corresponding with the column in $H'$ that matches $z$.

The error-checking method is unchanged, but the encoding rule certainly is not. The check digits are always determined by insisting that $H'x^T = 0$, and you have to redo the row-by-row solve to find out what they are. The other feature that may change is where the check and information digits sit: typically the check digits are placed so that their corresponding columns in $H'$ are the standard basis vectors $e_i$, because then each check digit appears in exactly one of the three equations and can be read off immediately. If you put a check digit somewhere else, the three equations tangle together and you have to solve a genuine simultaneous system.

Example. Consider the non-standard Hamming matrix

$$H' = \begin{pmatrix} 1 & 0 & 0 & 1 & 1 & 1 & 0 \\ 0 & 1 & 0 & 1 & 1 & 0 & 1 \\ 0 & 0 & 1 & 1 & 0 & 1 & 1 \end{pmatrix}.$$

Supposing that the information digits are in the last four positions, decode the received message $y = (1,0,1,1,1,0,1)$, assuming at most one error.
First read off which positions each row of $H'$ selects: row $1$ has $1$s in positions $1,4,5,6$; row $2$ in positions $2,4,5,7$; row $3$ in positions $3,4,6,7$. Computing $z = H'y^T$ over $\mathbb{Z}_2$,

$$\begin{align*} z_1 &= y_1 + y_4 + y_5 + y_6 \\ &= 1 + 1 + 1 + 0 \\ &= 1, \\ z_2 &= y_2 + y_4 + y_5 + y_7 \\ &= 0 + 1 + 1 + 1 \\ &= 1, \\ z_3 &= y_3 + y_4 + y_6 + y_7 \\ &= 1 + 1 + 0 + 1 \\ &= 1, \end{align*}$$

so $z = (1,1,1)^T \neq 0$ and an error has occurred. Now hunt for the column of $H'$ equal to $(1,1,1)^T$; scanning across, the only all-ones column is the fourth. Do not convert $z$ to a number here — with a non-standard matrix the columns are not in counting order, so position $4$ has nothing to do with $z$ "being" $7$ in binary; you must physically match the column. Flipping digit $4$ of $y$ gives the corrected codeword

$$(1, 0, 1, 0, 1, 0, 1),$$

and since the information digits live in the last four positions, the message is $(0, 1, 0, 1)$. Therefore, the decoded message is $(0,1,0,1)$.

Example. Find the encoding rule for the previous Hamming code, using the same non-standard Hamming matrix $H'$, where the information digits are placed in the last four positions.
Write the codeword as $x = (x_1, x_2, x_3, a, b, c, d)$, so that $x_1, x_2, x_3$ are the check digits and $a,b,c,d$ are the information digits. Notice first that the columns in positions $1, 2, 3$ of $H'$ are $e_1, e_2, e_3$, so each check digit appears in exactly one equation; this is the situation we wanted. Now impose $H'x^T = 0$ row by row:

$$\begin{align*} \text{row } 1 &: x_1 + a + b + c = 0 &&\implies x_1 = a + b + c, \\ \text{row } 2 &: x_2 + a + b + d = 0 &&\implies x_2 = a + b + d, \\ \text{row } 3 &: x_3 + a + c + d = 0 &&\implies x_3 = a + c + d, \end{align*}$$

where again we used $-1 = 1$ in $\mathbb{Z}_2$, so rearranging never introduces a minus sign. Therefore, the encoding rule is

$$x = (a+b+c,\ a+b+d,\ a+c+d,\ a,\ b,\ c,\ d),$$

with all entries computed in $\mathbb{Z}_2$.

As a sanity check, run the message $(a,b,c,d) = (0,1,0,1)$ recovered in the previous example through this rule:

$$\begin{align*} a + b + c &= 0 + 1 + 0 = 1, \\ a + b + d &= 0 + 1 + 1 = 0, \\ a + c + d &= 0 + 0 + 1 = 1, \end{align*}$$

giving $x = (1,0,1,0,1,0,1)$, which is exactly the corrected codeword we obtained. Two independent calculations agreeing like this is the best evidence you will get in an exam that both of them are right.

Example. Consider the non-standard Hamming matrix

$$H'' = \begin{pmatrix} 1 & 1 & 1 & 0 & 1 & 0 & 0 \\ 0 & 1 & 1 & 1 & 0 & 1 & 0 \\ 1 & 1 & 0 & 1 & 0 & 0 & 1 \end{pmatrix}$$

over $\mathbb{Z}_2$, where the last three entries of an encoded message are the check digits.
(a) Find the encoding rule.
(b) Assuming there is at most one error, decode the message $(0,0,0,1,1,1,0)$.

(a) The columns in positions $5, 6, 7$ are $e_1, e_2, e_3$, which is consistent with the check digits being placed there. Write $x = (a,b,c,d,x_5,x_6,x_7)$. Row $1$ has $1$s in positions $1,2,3,5$; row $2$ in positions $2,3,4,6$; row $3$ in positions $1,2,4,7$. Imposing $H''x^T = 0$,

$$\begin{align*} \text{row } 1 &: a + b + c + x_5 = 0 &&\implies x_5 = a + b + c, \\ \text{row } 2 &: b + c + d + x_6 = 0 &&\implies x_6 = b + c + d, \\ \text{row } 3 &: a + b + d + x_7 = 0 &&\implies x_7 = a + b + d. \end{align*}$$

Therefore, the encoding rule is $x = (a,\ b,\ c,\ d,\ a+b+c,\ b+c+d,\ a+b+d)$.

(b) With $y = (0,0,0,1,1,1,0)$, computing $z = H''y^T$ over $\mathbb{Z}_2$,

$$\begin{align*} z_1 &= y_1 + y_2 + y_3 + y_5 \\ &= 0 + 0 + 0 + 1 \\ &= 1, \\ z_2 &= y_2 + y_3 + y_4 + y_6 \\ &= 0 + 0 + 1 + 1 \\ &= 0, \\ z_3 &= y_1 + y_2 + y_4 + y_7 \\ &= 0 + 0 + 1 + 0 \\ &= 1, \end{align*}$$

so $z = (1,0,1)^T$, which matches the first column of $H''$. Flipping digit $1$ gives the corrected codeword $(1,0,0,1,1,1,0)$, and the information digits are the first four, namely $(1,0,0,1)$. Therefore, the decoded message is $(1,0,0,1)$. Checking against part (a) with $a=1, b=0, c=0, d=1$: $x_5 = 1+0+0 = 1$, $x_6 = 0+0+1 = 1$, $x_7 = 1+0+1 = 0$, giving $(1,0,0,1,1,1,0)$ as required.

Notice how in both non-standard examples the answer came out of the same three-step routine, and the matrix never had to be memorised:

• Identify which positions hold check digits (look for the columns that are $e_1, e_2, e_3$).
• For the encoding rule, read each row of $H'$ as "the sum of the digits in these positions is $0$", and solve each row for its check digit.
• For decoding, compute $z = H'y^T$ by the same row-selects-positions rule, then match $z$ against the columns of $H'$ by eye.

Larger Hamming Codes#

The Hamming $(7,4)$ code is so-called because it encodes messages of length $4$ as messages of length $7$; that is, it introduces $3$ check digits. Hamming codes of other sizes are designed in exactly the same fashion, and the pattern is driven entirely by the columns.

With $r$ rows, the columns of $H$ can be any nonzero binary strings of length $r$, and there are $2^r - 1$ of those; so the longest codeword we can protect with $r$ check digits has $2^r - 1$ digits, of which $2^r - 1 - r$ carry information. This gives the family

$$\boxed{\text{Hamming } (2^r - 1,\ 2^r - 1 - r) \text{ for } r = 2, 3, 4, \dots}$$

so $r = 3$ gives $(7,4)$, $r = 4$ gives $(15,11)$, $r = 5$ gives $(31, 26)$, and so on. Notice what happens to the rate: $\tfrac47 \approx 0.57$, then $\tfrac{11}{15} \approx 0.73$, then $\tfrac{26}{31} \approx 0.84$. Bigger Hamming codes are much more efficient, but they still only correct one error per block; a long block is a bigger target, so the single-error assumption gets harder to justify as $r$ grows. That trade-off is the whole design problem.

The next one up uses the standard Hamming $(15,11)$ matrix

$$H = \begin{pmatrix} 1 & 0 & 1 & 0 & 1 & 0 & 1 & 0 & 1 & 0 & 1 & 0 & 1 & 0 & 1 \\ 0 & 1 & 1 & 0 & 0 & 1 & 1 & 0 & 0 & 1 & 1 & 0 & 0 & 1 & 1 \\ 0 & 0 & 0 & 1 & 1 & 1 & 1 & 0 & 0 & 0 & 0 & 1 & 1 & 1 & 1 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 1 & 1 & 1 & 1 & 1 & 1 & 1 \end{pmatrix},$$