Marin Ivezic
A good superconducting qubit holds a coherent state for roughly 100 microseconds. A two-qubit gate on the same device takes tens of nanoseconds and fails a few times in every thousand attempts. Everything else in quantum computing follows from those two numbers. Factoring a 2048-bit RSA modulus with Shor’s algorithm calls for something on the order of a billion logical operations, and on a superconducting device the usable window before decoherence runs to a few thousand two-qubit gate times. Quantum error correction is the engineering discipline that closes that gap, and it closes it by spending three things: physical qubits, wall-clock time, and a large amount of classical computing running alongside the quantum device.
This article works through the mechanism from the bottom up. It starts with a code you can check by hand and ends with the arithmetic behind the million-qubit figures in vendor roadmaps.
What actually goes wrong
Classical hardware has one failure mode worth designing around. A bit that should read 0 reads 1. Quantum hardware has two, and the second one has no classical counterpart at all.
Bit flips exchange |0⟩ and |1⟩ and leave everything else alone. Physically this looks like a stray excitation, or a control pulse that rotates a little too far. In operator terms it is the Pauli X matrix, and it does to a qubit roughly what a flipped bit does to a byte.
Phase flips leave |0⟩ untouched and multiply |1⟩ by −1. Measure the qubit in the computational basis and nothing has changed. Measure it in the superposition basis and everything has: the state (|0⟩ + |1⟩)/√2 becomes (|0⟩ − |1⟩)/√2, its opposite. This is the Pauli Z operator. Interference is the resource quantum algorithms actually consume, and a phase flip corrupts interference while leaving the populations untouched. A classical bit has no phase, so nothing in classical coding theory prepared us for this one.
Apply both and we get the Pauli Y error. Those three operators, together with doing nothing, span every possible operation on a single qubit. A code that handles X, Y and Z on any one qubit handles everything that can happen to that qubit.
Depolarizing noise is the modelling convenience built on top of them. With some probability p the qubit suffers a random X, Y or Z, and otherwise it survives the step intact. Real devices are rarely that symmetric, and most published threshold figures assume they are, so a threshold quoted under depolarizing noise is an idealization rather than a measurement.
Amplitude damping is energy loss, and unlike depolarizing noise it has a direction. An excited qubit emits a photon and falls to the ground state, so |1⟩ decays to |0⟩ and not the reverse. T1 is the number that measures it.
Leakage is the error that breaks the assumptions the codes are built on. A transmon is not a two-level system. It is the bottom two rungs of an anharmonic ladder, and a badly shaped pulse can drive population into |2⟩. Every code assumes the qubit is somewhere inside the two-dimensional space it protects. A leaked qubit is not. It produces no clean syndrome, it corrupts its neighbours through two-qubit gates, and it stays leaked until something resets it. Hardware teams handle this with dedicated reset operations that push the population back down, turning an uncorrectable event into an ordinary Pauli error the code already knows how to fix.
Why discrete errors are enough
That list looks incomplete, and the objection is a fair one. Real noise is continuous. An over-rotation of 0.4 degrees is not a bit flip. It is a small fraction of one, and there are infinitely many such fractions.
Syndrome measurement resolves this, and the resolution is the single idea everything below rests on. Each check asks a yes-or-no question about a group of qubits, and the answer projects the state. A tiny coherent over-rotation is a superposition of “no error” and “full X error”, and the projection resolves it into one or the other, with probability proportional to the size of the rotation. Continuous physical noise becomes a stream of discrete, classical, correctable events. Analog problem in, digital problem out.
Why the classical playbook doesn’t transfer
Server memory has used single-error-correcting Hamming codes since the 1970s. RAID 5 rebuilds a lost disk from a parity stripe. Both rest on two operations that are freely available in classical hardware and unavailable here: read the data, and copy it.
Copying is forbidden outright. Wootters and Zurek, and independently Dieks, showed in 1982 that no physical process can produce an independent copy of an unknown quantum state. A repetition code in the classical sense is not expensive here. It is impossible.
Reading destroys what it reads. Measuring a qubit to check on it collapses the superposition being protected. The diagnostic would do the damage.
A classical code protects the wrong thing. Triplicate a qubit in the computational basis and you have some defence against X errors and none at all against Z errors, which pass through untouched and unseen.
Quantum error correction gets past all three obstacles with one move. Encode the logical qubit into an entangled state spread across many physical qubits, then measure relationships between qubits instead of the qubits themselves. A parity check answers “did an odd number of these qubits flip?” without ever revealing whether any individual one is 0 or 1.
Three qubits, one bit flip, worked through
Take an arbitrary state α|0⟩ + β|1⟩ and encode it as α|000⟩ + β|111⟩.
That is not three copies. Three copies would be a product of three separate qubits, a different state entirely, and forbidden. What we have instead is an entangled superposition of two bit strings, in which α and β appear once across the three qubits rather than once per qubit.
Now define two checks, Z₁Z₂ and Z₂Z₃. Each asks whether a pair of qubits agrees. Implement each with one ancilla qubit and two CNOT gates, then measure the ancilla. These operators are the stabilizers of the code, meaning the encoded states are left unchanged by them and return +1 on both.
An X error on a qubit anticommutes with any check that touches it and flips that check’s outcome to −1. Four outcomes, four diagnoses:
| Z₁Z₂ | Z₂Z₃ | Diagnosis |
|---|---|---|
| +1 | +1 | no error |
| −1 | +1 | qubit 1 flipped |
| −1 | −1 | qubit 2 flipped |
| +1 | −1 | qubit 3 flipped |
Apply X to the indicated qubit and the encoded state is restored. The table contains no α, β, or anything derived from them. The syndrome describes the error and says nothing whatsoever about the data. That separation is the entire design.
Two limits are worth working out. Two flips in the same round produce exactly the syndrome of a single flip on the third qubit, so the correction makes matters worse rather than better. And a Z error is invisible. Z₁ commutes with both checks, so the syndrome reads +1, +1 while the encoded state has quietly become α|000⟩ − β|111⟩. That is a logical phase flip, and the code never noticed.
Shor’s nine qubits
Peter Shor’s 1995 code closed that blind spot by stacking two layers. The outer layer is a three-qubit repetition code written in the |+⟩, |−⟩ basis, and it catches phase flips exactly as the code above catches bit flips. Each of those three qubits is then replaced by a three-qubit bit-flip block. Nine physical qubits, one logical qubit, and any single-qubit error of any type is corrected.
Shor’s construction settled the question that mattered in 1995: quantum information can be protected without being copied and without being read. As an engineering proposal it is expensive, and stacking layers multiplies rather than adds. A third layer costs 81 qubits for one logical qubit.
Steane’s seven and the CSS recipe
Andrew Steane’s 1996 code encodes one logical qubit into seven physical ones and corrects any single-qubit error, using two fewer qubits than Shor’s. It is built from the classical [7,4,3] Hamming code, used twice over: once against bit flips and once against phase flips. Six stabilizer generators, three of X type and three of Z type.
Generalised, this is the Calderbank-Shor-Steane recipe, universally shortened to CSS. Take a classical linear code with the right self-orthogonality property, use its parity checks in the Z basis to catch X errors and in the X basis to catch Z errors, and the two sets of checks commute, so they can be measured together without interfering. The payoff is practical rather than aesthetic. X and Z errors decode independently, using classical decoders that coding theorists have spent seventy years optimising. Most codes in use today, the surface code included, are CSS codes.
The surface code
Two properties made the surface code the default choice for superconducting and neutral-atom hardware.
Locality is the first. Alexei Kitaev’s toric code, from 1997, and the planar version worked out shortly afterwards, place data qubits on a two-dimensional grid with a measurement qubit sitting between them. Every check involves one measurement qubit and its four nearest neighbours. Nothing needs to talk to anything far away. That fits a fabricated chip in a way that all-to-all connectivity does not.
The threshold is the second. Below a certain physical error rate, making the code bigger makes the logical error rate smaller. Above it, bigger is worse, since more qubits introduce more errors than the code can absorb. Fowler and colleagues put the surface code’s threshold near 1 percent under circuit-level depolarizing noise, and the figure falls under noise models and decoders that resemble real hardware. Google’s Willow experiment, described below, showed logical error falling as the code grew, which is the measured sign that a device is operating below threshold.
The size of a patch is set by its distance d, the smallest number of physical errors that can combine into an undetected logical error. A distance-d code corrects up to (d−1)/2 errors, rounded down. In the rotated layout, a distance-d logical qubit uses d² data qubits and d²−1 measurement qubits, so 2d²−1 in total. Distance 3 costs 17 physical qubits. Distance 7 costs 97. Distance 25 costs 1,249.
The device does not run this once. It repeats the full round of checks continuously, roughly once per microsecond on superconducting hardware, and the decoder works over a history of syndromes rather than a single snapshot.
What Google measured
In 2024 Google reported a distance-7 surface code running on its 105-qubit Willow processor with a logical error rate of about 0.143 percent per cycle. Each increase of the distance by two cut the logical error rate by a factor of roughly 2.14. That factor, conventionally written Λ, is the number to watch in any experimental result. Λ greater than 1 means the code is below threshold and that scaling up will help. Λ at or below 1 means adding qubits makes the logical qubit worse.
The distance-7 patch also outlived the best single physical qubit on the same chip. That is the break-even condition the field had been chasing since the theory arrived in the mid-1990s.
The decoder is part of the machine
A syndrome stream is useless until something interprets it. For the surface code the standard approach treats the syndrome history as a graph and finds the minimum-weight set of errors consistent with what was observed, using minimum-weight perfect matching or the substantially faster union-find algorithm. Neural-network decoders are an active line of research and have matched or beaten matching-based decoders on real device data.
The binding constraint is latency rather than accuracy. The device produces a new syndrome round roughly every microsecond. A decoder taking two microseconds per round falls one round further behind on every cycle, and the backlog grows without limit. Real-time decoding at scale needs dedicated classical hardware sitting close to the cryostat, and the syndrome bandwidth coming off a million-qubit machine is very large. The classical computer attached to a fault-tolerant quantum computer is not a laptop.
The arithmetic that sets hardware budgets
This section is arithmetic-heavy, and the arithmetic is what decides how many qubits a vendor has to build.
Below threshold, logical error falls geometrically with distance. Take Λ = 2 and a starting point of roughly 10⁻³ per cycle at distance 7. A billion-operation algorithm needs a logical error rate somewhere around 10⁻¹⁰, so the error has to be suppressed by seven orders of magnitude. At one halving per two steps of distance, that is about 23 halvings, so the distance rises by about 46, to roughly 53. A distance-53 logical qubit costs 2(53²) − 1 = 5,617 physical qubits. Multiply by the few thousand logical qubits a cryptographically relevant Shor implementation needs and the total runs into the millions.
Every part of that estimate moves with Λ. Better gates raise Λ, a higher Λ cuts the distance needed for the same suppression, and cutting distance cuts qubit count quadratically. This is why experimental teams report Λ rather than gate fidelity alone.
Published resource estimates follow the same logic with far more care than the sketch above. Craig Gidney and Martin Ekerå estimated in 2019 that factoring RSA-2048 would take 20 million noisy physical qubits and about 8 hours. Gidney’s 2025 revision brought that requirement under a million, on the strength of algorithmic improvements and better use of the same code rather than better hardware. Neither figure is a prediction about a date. Both are statements about the exchange rate between physical qubits and useful logical work, and that exchange rate keeps moving.
Codes that cost less
The surface code’s overhead is the price of its own best feature. Strict two-dimensional locality forces the qubit count to grow with d². Quantum low-density parity-check codes, usually shortened to qLDPC codes, relax locality in return for a far better rate.
IBM’s bivariate bicycle construction, published in Nature in 2024, encodes 12 logical qubits at distance 12 into 288 physical qubits. The surface code needs 287 physical qubits for a single distance-12 logical qubit, so roughly 3,400 for twelve of them. The saving is about an order of magnitude.
The cost is connectivity. Each check touches six qubits rather than four, and some of those connections reach past nearest neighbours, so the layout needs a second wiring layer or genuinely long-range couplers. Decoding is harder too. The clean graph structure that makes matching fast for the surface code does not carry over, and general qLDPC decoding remains an open research problem with young solutions. The trade is qubits against connectivity and classical difficulty, and which side wins depends entirely on what the hardware can build.
Bosonic codes, a different bet
Everything above spends redundancy, using many two-level systems to stand in for one. Bosonic codes spend structure instead. A microwave cavity or a trapped-ion motional mode has an infinite ladder of energy levels, and a logical qubit encoded across many of those levels can be protected inside a single physical device.
Cat codes encode the logical states in superpositions of two coherent states, |α⟩ and |−α⟩, named after the cat in the thought experiment. The dominant error in a cavity is single-photon loss, and losing one photon flips the photon-number parity from even to odd. Parity can be measured without disturbing the encoded information, so the dominant error announces itself. Engineered well, cat qubits suffer bit flips exponentially rarely in |α|², and what remains is a strongly biased noise channel dominated by phase errors. Biased noise is cheap to correct, since a plain repetition code handles one error type. Alice & Bob has built its whole architecture around exactly this bias, and Amazon’s Ocelot chip, announced in February 2025, uses concatenated cat qubits for the same reason.
GKP codes, proposed by Daniel Gottesman, Alexei Kitaev and John Preskill in 2001, encode a qubit into a periodic grid of states in phase space. Small displacements in position or momentum, the continuous analog errors that dominate an oscillator, shift the state off the grid points, and measuring the displacement modulo the grid spacing reveals the shift without revealing which logical state is stored. Ideal GKP states require infinite squeezing. Finite approximations have been produced in both superconducting cavities and trapped ions.
Binomial codes, introduced by Marios Michael and colleagues in 2016, use finite superpositions of photon-number states. The simplest example stores logical zero as (|0⟩ + |4⟩)/√2 and logical one as |2⟩. Every codeword has even photon number, so a single loss puts the state on an odd number and a parity measurement catches it. These states are considerably easier to prepare than ideal GKP states.
One catch runs across all three families. Syndrome extraction depends on an ancillary two-level qubit coupled to the mode, and errors in that ancilla can propagate into the encoded state. Bosonic encodings reduce the qubit count and move the difficulty into state preparation and control.
Error mitigation is a different thing entirely
Mitigation methods reduce the error in a computed number. They do not preserve a quantum state.
- Zero-noise extrapolation runs the same circuit at deliberately amplified noise levels, then extrapolates the measured expectation value back to zero noise. Amplification is usually done by folding gates, replacing U with U U† U. The extrapolation assumes a noise model, so the result carries a bias you cannot quantify from the data alone.
- Probabilistic error cancellation characterises the noise channel, then samples from a quasiprobability decomposition of its inverse. The estimator is unbiased, which zero-noise extrapolation is not. The sampling cost grows exponentially with circuit volume, and that exponential is the whole story at any interesting depth.
- Dynamical decoupling inserts pulse sequences on idle qubits to refocus slow noise, borrowed directly from spin echo in nuclear magnetic resonance. It extends useful coherence and costs nothing but pulse time.
- Readout mitigation and symmetry postselection either correct or discard. Calibrate the measurement confusion matrix and invert it, or check a conserved quantity such as particle number and throw away every run that violates it. Discarding runs is cheap at low error rates and ruinous at high ones.
All four are useful today and all four are dead ends for deep circuits. Vendors sometimes present mitigation results and correction results on the same slide as points along one road. They are not on one road. Mitigation buys accuracy in an averaged quantity across many shots. Correction buys a state that survives.
What is still unsolved
Logical gates are the unfinished half of the problem. Storing a logical qubit and computing with one are separate engineering tasks, and almost every headline result so far concerns storage. Clifford gates through lattice surgery are understood and demonstrated. The T gate is not transversal in the surface code, and the standard route is magic state distillation: prepare many noisy copies of a special state, then consume most of them to purify a few. Distillation factories can occupy more of a processor than the algorithm they serve, and they are one of the largest line items in any fault-tolerance budget.
Correlated errors violate the assumption the codes are built on. Cosmic rays and other high-energy impacts produce bursts that strike large regions of a superconducting chip at once, wiping out many qubits in a single event. Gap engineering and normal-metal phonon traps both help. Neither is finished.
Leakage and reset remain an active engineering problem at scale, for the reasons set out earlier.
Yield and calibration scale badly. A distance-53 patch containing one dead qubit needs either a code that tolerates the hole or a fabrication process that never produces it. Calibrating a million qubits on a daily cycle is a discipline of its own, and largely an unwritten one.
Classical infrastructure is the quiet constraint. Real-time decoding, cryogenic control electronics and syndrome bandwidth together make the classical side of a fault-tolerant machine a supercomputing problem in itself.
Reading a roadmap
Six questions separate a demonstration from a claim:
- Physical qubits or logical qubits, and demonstrated or announced?
- Which code, at what distance, and over how many rounds?
- Is Λ reported, and across how many distances? A single distance shows nothing about scaling.
- Logical error per cycle, or per algorithm? A per-cycle rate of 10⁻³ is a per-algorithm failure rate close to certainty after a thousand cycles.
- Was the decoder real-time, or applied offline after the fact? Offline decoding is a valid physics result and not a working machine.
- Did the logical qubit beat the best physical qubit on the same device, or an average across devices?
Answer those six and most roadmap claims sort themselves into order.
Where to take this next
Error correction is where hardware engineering, coding theory and real-time classical computing meet. Anyone who will specify, procure or build on quantum hardware over the next decade will eventually be asked to judge a claim of the kind in that list of six.
Quantum Academy’s technical programs work through this material with the derivations and the resource calculations done out in full rather than quoted, including the code constructions sketched here and the fault-tolerant gate constructions that sit on top of them. The full program catalog is at quantumacademy.com/. For longer technical treatments of individual codes and of the cryptographic timelines that depend on error-corrected hardware, PostQuantum.com carries deeper write-ups.