CSS Codes

Classical error correction has a century-old toolbox: linear codes, parity checks, dual codes, minimum distances. Quantum error correction seemed to need something entirely new, because a qubit can fail in two independent ways at once — a bit flip $X$ and a phase flip $Z$ — and because the stabilizers you measure to catch those failures must all commute or they cannot be measured together. The CSS construction, found independently by Calderbank and Shor and by Steane in 1996, is the discovery that you do not need something new. You import the classical toolbox twice: one classical binary code $C_1$ to beat bit flips in the computational basis, and a second code $C_2^{\perp}$ to beat phase flips in the Hadamard basis. A single algebraic condition — the nesting $C_2 \subseteq C_1$ — is exactly what forces the two families of quantum checks to commute, and everything else about the code (its parameters, its logical operators, its transversal gates) then follows by turning a crank you already own from classical coding theory. That one inclusion is the whole recipe, and its reach is enormous. The parity checks of $C_1$ become the $Z$ -type stabilizers that flag bit flips; the parity checks of $C_2^{\perp}$ become the $X$ -type stabilizers that flag phase flips; the codewords are uniform superpositions over cosets of $C_2$ inside $C_1$ . Because the $X$ and $Z$ checks never mix, decoding splits into two independent classical problems, the transversal CNOT is free, and self-dual choices buy transversal Hadamard and phase gates. The Steane seven-qubit code, the surface code, the color codes, and the modern "good" quantum LDPC codes are all CSS — which is why this one subclass, born from a two-line classical observation, is the working substrate of nearly all fault-tolerant quantum computing.

Key takeaways

A CSS code is a stabilizer code built from two classical binary linear codes $C_1$ and $C_2$ with $C_2 \subseteq C_1$ : the parity checks of $C_1$ catch bit-flip ( $X$ ) errors and the parity checks of $C_2^{\perp}$ catch phase-flip ( $Z$ ) errors.
The nesting $C_2 \subseteq C_1$ is algebraically identical to the commutation requirement $H_X H_Z^{T}=0$ , which is the only thing needed to make the two check families a valid, jointly measurable stabilizer group.
It is an $[[n,\,k_1-k_2,\,d]]$ code with $d \ge \min\big(d(C_1),\,d(C_2^{\perp})\big)$ : $n$ physical qubits, $k_1-k_2$ logical qubits (the number of cosets of $C_2$ in $C_1$ ), distance at least the smaller classical distance.
Because the $X$ -type and $Z$ -type checks are kept separate, syndrome decoding decouples into two independent classical decoders, and the transversal CNOT is logical for every CSS code.
Dual-containing codes ( $C_1=C_2^{\perp}$ ) add a transversal Hadamard, and doubly-even codes add a transversal phase gate — the Steane code, from the $[7,4,3]$ Hamming code, has the full transversal Clifford group.
Key idea: pick two classical binary linear codes with $C_2\subseteq C_1$ ; use the parity checks of $C_1$ as the $Z$ -stabilizers (against bit flips) and the parity checks of $C_2^{\perp}$ as the $X$ -stabilizers (against phase flips). The nesting is exactly $H_X H_Z^{T}=0$ , giving an $[[n,\ k_1-k_2,\ \ge\min(d(C_1),d(C_2^{\perp}))]]$ code that corrects $X$ and $Z$ errors independently.

Where this lives today

Nearly every serious effort to build a fault-tolerant quantum computer is running a CSS code. The dominant architecture is the surface code — a planar cousin of Kitaev's toric code, CSS by construction, with only nearest-neighbour $X$ and $Z$ checks and independent matching decoders for the two error types. In 2024 a Google superconducting processor ran a distance-five and then a distance-seven surface-code logical qubit whose logical error rate fell as the code grew, the long-sought below-threshold behaviour that CSS structure and local checks were designed to enable. Color codes, also CSS, trade a denser lattice for transversal access to more gates. At the frontier of theory, the "good" quantum LDPC codes proved to exist by Panteleev and Kalachev and by Leverrier and Zémor — codes with constant rate and linear distance, the asymptotic optimum Calderbank and Shor first showed was possible — are CSS codes built from balanced products, with neutral-atom hardware now demonstrating small instances. Even the non-Clifford $T$ gate that CSS transversality cannot supply is manufactured through magic-state distillation protocols themselves built from CSS codes. The two-line classical observation of 1996 has become the load-bearing structure of the whole field.

The physical picture

A quantum error has two independent dials. One flips the bit — a Pauli $X$ swapping $|0\rangle$ and $|1\rangle$ . The other flips the phase — a Pauli $Z$ swapping $|+\rangle$ and $|-\rangle$ . Discretization of errors tells us that beating each dial separately beats any error, since an arbitrary single-qubit fault is a combination of $\{I,X,Y,Z\}$ and $Y=iXZ$ is just both dials at once. CSS codes take this literally: they run two classical error-correcting schemes side by side, one in the computational basis to catch bit flips and one in the Hadamard basis to catch phase flips. The Hadamard gate bridges the two worlds — it maps $X \leftrightarrow Z$ , so the second scheme is the first wearing a Hadamard disguise. The only genuinely quantum requirement is that the two schemes not interfere when measured together, and that requirement has a compact classical translation. The first figure lays out the architecture and the single condition that makes it legal.

Why does the nesting force commutation? Two Paulis commute unless one is $X$ -type and the other $Z$ -type on an odd number of shared qubits. Every $X$ -stabilizer has support in $C_2$ ; every $Z$ -stabilizer has support in $C_1^{\perp}$ . Demanding an even overlap for every such pair means every $C_2$ vector is orthogonal to every $C_1^{\perp}$ vector — precisely $C_2 \subseteq (C_1^{\perp})^{\perp} = C_1$ . The single most useful move in the subject is to build both codes from one classical code: take a code $C$ whose dual sits inside it, $C^{\perp}\subseteq C$ , and set $C_1=C$ , $C_2=C^{\perp}$ . The nesting is then automatic, and the smallest interesting example — the $[7,4,3]$ Hamming code, which contains its own dual — produces the seven-qubit Steane code, the subject of the second figure.

Figure

The Steane seven-qubit code from one classical code: take C₁ as the 7,4,3 Hamming code and C₂ as its dual the 7,3,4 simplex code; the Hamming parity-check matrix H has every row of weight 4 and every row-pair overlapping in weight 2, so H Hᵀ = 0 mod 2, the nesting C₂ ⊆ C₁ holds, and the CSS rule delivers a quantum code with n = 7, k = 4 − 3 = 1, and d = min of 3 and 3 = 3 that corrects any single-qubit error

The core equations

The construction begins and ends with one set-theoretic inclusion. Two classical binary linear codes are chosen inside the same $n$ -bit space, one nested in the other; this single line is the entire hypothesis of the CSS theorem, and every property below is a consequence.

C_2 \subseteq C_1 \subseteq \mathbb{F}_2^{\,n} \qquad (1)

where: $C_1$ — a classical $[n,k_1,d_1]$ binary linear code whose parity checks correct bit-flip ( $X$ ) errors; $C_2$ — a classical $[n,k_2,d_2]$ linear code contained in $C_1$ , whose dual $C_2^{\perp}$ corrects phase-flip ( $Z$ ) errors; $\mathbb{F}_2^{\,n}$ — the space of $n$ -bit binary strings. Read it as: pick a big code $C_1$ and a smaller code $C_2$ living inside it, and the quantum code is squeezed between them. The logical codewords are the most concrete object in the theory: uniform superpositions over the cosets of $C_2$ inside $C_1$ . Distinct cosets are distinct logical states, so the logical alphabet is literally the quotient $C_1/C_2$ .

|x + C_2\rangle = \frac{1}{\sqrt{|C_2|}} \sum_{y \in C_2} |x+y\rangle,\qquad x\in C_1 \qquad (2)

where: $x$ — a representative codeword of $C_1$ labelling the coset; $y$ — runs over all $|C_2|=2^{k_2}$ words of $C_2$ ; the prefactor normalizes the superposition. Two representatives give the same state iff they differ by an element of $C_2$ , so the states are labelled by cosets $x+C_2$ , and there are $|C_1|/|C_2|$ of them. The commutation of all stabilizers — the condition that lets them be measured simultaneously without disturbing the codeword — reduces to a single matrix equation over $\mathbb{F}_2$ . This is the algebraic heart of CSS and the reason the construction works at all.

H_X\,H_Z^{T} = 0 \pmod 2 \qquad (3)

where: $H_X$ — the $k_2\times n$ matrix whose rows are the $X$ -type stabilizer supports, a generator matrix of $C_2$ (equivalently the parity-check matrix of $C_2^{\perp}$ ); $H_Z$ — the $(n-k_1)\times n$ parity-check matrix of $C_1$ , whose rows are the $Z$ -type stabilizer supports and span $C_1^{\perp}$ . The equation says every row of $H_X$ (a $C_2$ word) is orthogonal to every row of $H_Z$ (a $C_1^{\perp}$ word), which is exactly $C_2\subseteq C_1$ . The parameters fall out by counting. There are $(n-k_1)$ independent $Z$ -checks and $k_2$ independent $X$ -checks, so $n$ qubits minus $(n-k_1)+k_2$ generators leaves the logical count, and the distance is controlled by the two classical minimum distances.

[[\,n,\ k_1-k_2,\ d\,]],\qquad d \ge \min\big(d(C_1),\ d(C_2^{\perp})\big) \qquad (4)

where: $n$ — physical qubits, the shared block length; $k_1-k_2$ — logical qubits, equal to $\log_2(|C_1|/|C_2|)$ , the number of cosets; $d$ — the quantum distance, the minimum weight of any nontrivial logical operator. The bound is one-sided: degenerate codes can have $d$ strictly larger than $\min(d(C_1),d(C_2^{\perp}))$ . The logical operators are undetectable, non-stabilizer Paulis. Because the stabilizer group splits into $X$ -type and $Z$ -type, so do the logical operators, and each is read off directly from the classical codes as a coset representative.

\bar X = X(w),\ w\in C_1\setminus C_2;\qquad \bar Z = Z(v),\ v\in C_2^{\perp}\setminus C_1^{\perp} \qquad (5)

where: $\bar X$ — logical $X$ , an $X$ -string on a $C_1$ word not in $C_2$ — it moves between cosets, so it swaps logical states; $\bar Z$ — logical $Z$ , a $Z$ -string on a $C_2^{\perp}$ word not in $C_1^{\perp}$ — it applies coset-dependent signs; $\setminus$ — set difference, since representatives are fixed only modulo the stabilizer words $C_2$ and $C_1^{\perp}$ . Their minimum weights, $d(C_1)$ and $d(C_2^{\perp})$ , give the distance bound of equation (4). The first gift of the separable structure is that the two-qubit workhorse gate needs no encoding overhead. Applied qubit-by-qubit between two identical CSS blocks, the physical CNOT is the logical CNOT.

\overline{\mathrm{CNOT}} = \prod_{j=1}^{n}\mathrm{CNOT}_{\,j\to j'} \qquad (6)

where: $\mathrm{CNOT}_{j\to j'}$ — a physical CNOT from qubit $j$ of the control block to the aligned qubit $j'$ of the target block; the product runs over all $n$ aligned pairs. Because CNOT sends $X\otimes I\mapsto X\otimes X$ and $I\otimes Z\mapsto Z\otimes Z$ , and both blocks share the same $H_X,H_Z$ , every stabilizer maps to a product of stabilizers — the code space is preserved and the logical action is CNOT. The second gift arrives when the two classical codes coincide up to duality. A self-dual-containing code $C_1=C_2^{\perp}$ makes the transversal Hadamard logical, and a doubly-even code makes the transversal phase gate logical, delivering the entire Clifford group transversally.

\bar H = H^{\otimes n}\ \ (\text{if } C_1=C_2^{\perp}),\qquad \bar S = \textstyle\prod_j S_j^{\pm1}\ \ (\text{if } C_1\ \text{doubly-even}) \qquad (7)

where: $H^{\otimes n}$ — Hadamard on every qubit; it swaps the $X$ -check set (span $C_2$ ) with the $Z$ -check set (span $C_1^{\perp}$ ), which is stabilizer-preserving precisely when $C_2=C_1^{\perp}$ ; $\bar S$ — transversal phase gate, logical when every codeword weight of $C_1$ is $\equiv 0 \pmod 4$ (doubly-even), which controls the accumulated $i$ phases. The Steane code satisfies both, so its logical $H$ , $S$ , and CNOT are all transversal.

Derivation AWhy the nesting condition makes every stabilizer commute

The goal is to prove that the purely set-theoretic inclusion $C_2\subseteq C_1$ is one and the same statement as the physical requirement that all the CSS stabilizers commute, so that a valid quantum code drops out of a valid pair of classical codes with no further checking. We start from the symplectic commutation rule, specialize it to pure- $X$ and pure- $Z$ generators, collect the orthogonality conditions into a single matrix equation, and read that equation as a containment of classical codes.

Step 1. Two Pauli operators written in symplectic form, $X(a)Z(b)$ and $X(a')Z(b')$ , commute if and only if $a\cdot b' + a'\cdot b = 0 \pmod 2$ . For a pure- $X$ generator ( $a=r$ , $b=0$ ) and a pure- $Z$ generator ( $a'=0$ , $b'=s$ ) the condition collapses to $r\cdot s = 0$ . Why: only the $X$ -part of one operator can clash with the $Z$ -part of the other, so an even overlap of their supports is exactly what makes them commute.

Step 2. The $X$ -stabilizers of the CSS code have supports that are the rows of $H_X$ , which span $C_2$ ; the $Z$ -stabilizers have supports that are the rows of $H_Z$ , which span $C_1^{\perp}$ . Requiring $r\cdot s=0$ for every $X$ -row $r$ and every $Z$ -row $s$ is the single matrix equation $H_X H_Z^{T}=0 \pmod 2$ . Why: pairwise orthogonality of all rows is precisely what a vanishing matrix product records, so the whole commutation table compresses to one equation.

Step 3. Now decode that equation. Its rows say every element of $C_2$ (the rowspace of $H_X$ ) is orthogonal to every element of $C_1^{\perp}$ (the rowspace of $H_Z$ ), i.e. $C_2 \subseteq (C_1^{\perp})^{\perp}$ . Since $(C_1^{\perp})^{\perp}=C_1$ for any linear code, this is exactly $C_2\subseteq C_1$ . Why: orthogonality to the dual code is membership in the original code, so "commutes with all $Z$ -checks" is literally "lies in $C_1$ ."

Step 4. Same-type generators need no condition: two $X$ -type operators always commute, as do two $Z$ -type operators, because neither has a part that can clash with the other. So $C_2\subseteq C_1$ is not merely sufficient but necessary and complete — it is the whole content of "these Paulis form an abelian stabilizer group." Why: the only possible obstruction to a commuting group is the cross $X$ – $Z$ overlaps, and the nesting kills exactly those.

r\cdot s=0\ \ \forall\, r\in C_2,\ s\in C_1^{\perp}\ \Longleftrightarrow\ H_X H_Z^{T}=0\ \Longleftrightarrow\ C_2\subseteq C_1

Verified: the symplectic rule and its reduction to $H_X H_Z^{T}=0$ are standard (Gottesman 1997); the containment $C_2\subseteq(C_1^{\perp})^{\perp}=C_1$ uses only linear-algebra duality over $\mathbb{F}_2$ . Cross-checked against Nielsen and Chuang §10.4.2 and Preskill Ch. 7.

Go deeper · Derivation B · 2 minBuilding the Steane code from the Hamming code

Derivation BBuilding the Steane code from the Hamming code

The goal is to construct the smallest and most important CSS code entirely from a single classical code and its dual, so that the abstract nesting $C_2\subseteq C_1$ becomes a concrete $3\times 7$ matrix and the parameters $[[7,1,3]]$ appear by counting. We take the $[7,4,3]$ Hamming code as $C_1$ , show it contains its own dual so $C_2=C_1^{\perp}$ satisfies the nesting for free, use the one matrix for both check families, and read off the parameters and transversal gates.

Step 1. Write the Hamming parity-check matrix, the $3\times 7$ matrix $H$ whose seven columns are the nonzero binary $3$ -vectors, ordered $1$ through $7$ . The Hamming code is $C_1=\ker H$ , a $[7,4,3]$ code (rank $3$ , so dimension $4$ ; its minimum distance is $3$ ). Why: every classical linear code is defined by such a parity-check matrix, and the Hamming choice — all nonzero columns — is what gives it distance $3$ and single-error correction.

Step 2. Check self-orthogonality. Each row of $H$ has weight $4$ , so $r_i\cdot r_i=4\equiv 0$ ; and each pair of rows overlaps in weight $2$ , so $r_i\cdot r_j = 2\equiv 0$ . Hence $HH^{T}=0 \pmod 2$ , meaning $\mathrm{rowspace}(H)=C_1^{\perp}$ is contained in $\ker H = C_1$ . Setting $C_2=C_1^{\perp}$ gives $C_2\subseteq C_1$ with no extra work. Why: a dual-containing code hands you the nesting automatically, which is why the entire construction can be seeded by one classical code.

Step 3. Assign the stabilizers. Use $H$ as both the $Z$ -check matrix ( $H_Z=H(C_1)=H$ , three $Z$ -generators) and the $X$ -check matrix ( $H_X=G(C_2)=G(C_1^{\perp})=H$ , three $X$ -generators, since $C_1^{\perp}=\mathrm{rowspace}(H)$ ). Commutation is $H_X H_Z^{T}=HH^{T}=0$ , already verified. Why: because $C_2=C_1^{\perp}$ , the same matrix plays both roles, giving a strikingly symmetric code with six generators.

Step 4. Count the parameters. There are $6$ independent generators on $7$ qubits, so $k=7-6=1$ ; equivalently $k=k_1-k_2=4-3=1$ . The distance is $d\ge\min(d(C_1),d(C_2^{\perp}))=\min(3,3)=3$ , and it equals $3$ because $C_1$ has a weight- $3$ codeword outside $C_2$ . This is the $[[7,1,3]]$ Steane code, correcting any single-qubit error. Why: the coset count and the classical distances directly give $k$ and $d$ , no explicit codeword enumeration needed.

Step 5. Read off the transversal gates. Since $C_1=C_2^{\perp}$ , the transversal Hadamard $H^{\otimes 7}$ swaps the $X$ - and $Z$ -check sets and is logical; the Hamming/simplex structure additionally makes the transversal phase gate logical. With the always-available transversal CNOT, the Steane code realizes the full Clifford group transversally. Why: the dual-containing symmetry is exactly the property equation (7) needs, so the Steane code is the canonical fault-tolerant CSS code.

n=7,\quad k=4-3=1,\quad d=\min(3,3)=3\ \Rightarrow\ [[7,1,3]]

Verified: $HH^{T}=0\pmod 2$ by the explicit row weights ( $4$ ) and overlaps ( $2$ ); the $[7,4,3]$ Hamming parameters are standard; $[[7,1,3]]$ and the transversal Clifford set match Nielsen and Chuang §10.4.3 and Steane (1996).

Go deeper · Derivation C · 2 minCounting logical qubits and bounding the distance

Derivation CCounting logical qubits and bounding the distance

The goal is to establish the two headline numbers of equation (4) — that a CSS code encodes exactly $k_1-k_2$ logical qubits and has distance at least $\min(d(C_1),d(C_2^{\perp}))$ — directly from the coset picture and the definition of a logical operator, without ever touching the $2^n$ -dimensional Hilbert space. We count the coset states for the dimension, then identify undetectable non-stabilizer Paulis with nontrivial coset representatives for the distance.

Step 1. The logical basis states are the coset superpositions $|x+C_2\rangle$ of equation (2). Two are equal when $x-x'\in C_2$ and orthogonal otherwise, because distinct cosets have disjoint computational support. So the number of orthonormal logical states is the number of cosets of $C_2$ in $C_1$ . Why: the code space is spanned by these states and they are automatically an orthonormal basis, so counting them is counting the logical dimension.

Step 2. By Lagrange's theorem for the subgroup $C_2\le C_1$ , that number is $|C_1|/|C_2| = 2^{k_1}/2^{k_2} = 2^{k_1-k_2}$ . Taking logarithms, the code encodes $k=k_1-k_2$ logical qubits — matching the generator count $n-[(n-k_1)+k_2]$ . Why: the two independent counts agree, confirming the code space is $2^{k_1-k_2}$ -dimensional exactly as claimed.

Step 3. Now the distance. An $X$ -error $X(e)$ is undetectable iff it commutes with all $Z$ -checks, i.e. $H_Z e=0$ , i.e. $e\in\ker H_Z = C_1$ ; it acts nontrivially (is not itself a stabilizer) iff $e\notin C_2$ . So the lightest logical $X$ has weight $\min_{e\in C_1\setminus C_2}\mathrm{wt}(e)\ge d(C_1)$ . Why: an undetectable error that still changes the codeword is exactly a logical operator, and here those live in the coset difference $C_1\setminus C_2$ .

Step 4. By the Hadamard-mirrored argument, a $Z$ -error $Z(f)$ is undetectable iff $H_X f=0$ , i.e. $f\in C_2^{\perp}$ , and nontrivial iff $f\notin C_1^{\perp}$ , so the lightest logical $Z$ has weight $\ge d(C_2^{\perp})$ . The code distance, the minimum weight over all nontrivial logicals, is therefore $\ge\min(d(C_1),d(C_2^{\perp}))$ . Why: $X$ -type and $Z$ -type logicals are bounded separately by the two classical distances, and the smaller one dominates.

\dim(\text{code}) = \frac{|C_1|}{|C_2|}=2^{k_1-k_2},\qquad d=\min_{\substack{w\in C_1\setminus C_2\\ v\in C_2^{\perp}\setminus C_1^{\perp}}}\!\min\big(\mathrm{wt}(w),\mathrm{wt}(v)\big)\ \ge\ \min\big(d(C_1),d(C_2^{\perp})\big)

Verified: the coset count is Lagrange's theorem applied to $C_2\le C_1$ ; the distance identification of undetectable non-stabilizer Paulis with $C_1\setminus C_2$ and $C_2^{\perp}\setminus C_1^{\perp}$ follows the definition of a logical operator (Preskill Ch. 7). The bound is not tight for degenerate codes. Cross-checked against Wilde Ch. 10 and Calderbank–Shor (1996).

Limiting cases

The single recipe $C_2\subseteq C_1$ specializes into every important family of quantum codes; pushing the two classical codes to extremes shows both the power and the boundaries of the construction.

Case	Result	Meaning
Dual-containing code	$C_1=C,\ C_2=C^{\perp},\ C^{\perp}\subseteq C$	One weakly self-dual code seeds the whole code, giving $[[n,\,2k-n,\,d]]$ ; the route to the Steane code and to a transversal Hadamard.
Doubly-even self-dual	$C=C^{\perp},\ \mathrm{wt}(x)\equiv 0\!\pmod 4$	Adds a transversal phase gate on top of $H$ and CNOT, completing the transversal Clifford group — the Steane code's gate set.
Topological (surface/toric)	$H_X=\partial_2,\ H_Z=\partial_1^{T},\ \partial_1\partial_2=0$	On a cell complex the boundary maps furnish commuting local checks; $H_X H_Z^{T}=0$ becomes $\partial_1\partial_2=0$ and logical operators are homology classes.
Trivial code	$C_2=\{0\},\ C_1=\mathbb{F}_2^{\,n}$	Then $k=n$ but $d(C_2^{\perp})=d(\mathbb{F}_2^{\,n})=1$ , so $d=1$ : no protection. The recipe is empty unless both codes are genuinely structured.

Common trapThe nesting has a direction, and the distance is only a lower bound

Two traps sit at the entrance to CSS codes. First, the inclusion is directional: it is $C_2\subseteq C_1$ , with the $Z$ -checks (against bit flips) coming from $C_1$ 's parity checks and the $X$ -checks (against phase flips) coming from $C_2^{\perp}$ 's parity checks. Swap $C_1$ and $C_2$ , or forget that the phase checks use the dual $C_2^{\perp}$ , and the commutation condition $H_X H_Z^{T}=0$ fails — you no longer have a stabilizer code at all. Second, the parameter formula gives $d\ge\min(d(C_1),d(C_2^{\perp}))$ , an inequality, not an equality. For degenerate codes — where many distinct errors share a syndrome and act identically on the code space, as in the surface code — the true distance can exceed the classical bound. Quoting $\min(d(C_1),d(C_2^{\perp}))$ as "the distance" is safe as a guarantee but can badly understate the real protection.

Worked examples

1 · The Steane code, fully worked from the Hamming matrix

Take $C_1$ to be the $[7,4,3]$ Hamming code with the parity-check matrix $H$ whose columns are $1$ through $7$ in binary, and $C_2=C_1^{\perp}$ . Verify the nesting numerically, and compute $n$ , $k$ , $d$ , the number of stabilizers, and the transversal gates.

Step 1. Confirm self-orthogonality by hand. The three rows are $r_1=0001111$ , $r_2=0110011$ , $r_3=1010101$ . Each has weight $4$ , so $r_i\cdot r_i=4\equiv 0\pmod 2$ . The pairwise overlaps are $r_1\cdot r_2=|\{6,7\}|=2$ , $r_1\cdot r_3=|\{5,7\}|=2$ , $r_2\cdot r_3=|\{3,7\}|=2$ , all $\equiv 0$ . Therefore $HH^{T}=0\pmod 2$ , so $C_2=\mathrm{rowspace}(H)\subseteq\ker H=C_1$ . The nesting $C_2\subseteq C_1$ holds.

Step 2. Dimensions. $H$ has rank $3$ , so $C_1=\ker H$ has dimension $k_1=7-3=4$ and $C_2=C_1^{\perp}=\mathrm{rowspace}(H)$ has dimension $k_2=3$ . The logical count is $k=k_1-k_2=4-3=\mathbf{1}$ , and equivalently $\log_2(|C_1|/|C_2|)=\log_2(16/8)=1$ . One logical qubit.

Step 3. Distance. Logical $X$ lives in $C_1\setminus C_2$ ; the lightest such word has weight $d(C_1)=3$ . Logical $Z$ lives in $C_2^{\perp}\setminus C_1^{\perp}=C_1\setminus C_1^{\perp}$ ; the lightest has weight $d(C_2^{\perp})=d(C_1)=3$ . So $d=\min(3,3)=\mathbf{3}$ , and the code corrects $t=\lfloor(3-1)/2\rfloor=1$ arbitrary single-qubit error. Distance $3$ , $[[7,1,3]]$ .

Step 4. Stabilizers and gates. There are $n-k_1=3$ independent $Z$ -checks and $k_2=3$ independent $X$ -checks, $6$ generators on $7$ qubits, leaving $7-6=1$ logical qubit — consistent with Step 2. Because $C_1=C_2^{\perp}$ , the transversal Hadamard is logical; the doubly-even structure makes the transversal phase gate logical; the transversal CNOT is automatic. Six stabilizers, and a full transversal Clifford group $\{H,S,\mathrm{CNOT}\}$ — the reason the Steane code is the standard fault-tolerant building block.

2 · The toric code as a CSS code, and its parameters

The toric code places one qubit on each edge of an $L\times L$ square lattice with periodic boundaries. Its $X$ -checks are the vertex operators $A_v$ (a product of $X$ on the four edges meeting a vertex) and its $Z$ -checks are the plaquette operators $B_p$ (a product of $Z$ on the four edges of a face). Show it is CSS, and find $[[n,k,d]]$ for $L=3$ .

Step 1. CSS structure. Every $A_v$ is purely $X$ -type and every $B_p$ is purely $Z$ -type, so the stabilizers already split into an $X$ -block and a $Z$ -block — the defining CSS form. Any vertex and any plaquette share either $0$ or $2$ edges, so $A_v$ and $B_p$ overlap on an even number of qubits and commute; in homological language $H_X=\partial_2$ , $H_Z=\partial_1^{T}$ , and $H_X H_Z^{T}=\partial_1\partial_2=0$ . It is a CSS code with geometrically local checks.

Step 2. Count qubits and generators. On an $L\times L$ torus there are $2L^2$ edges, so $n=2L^2$ . There are $L^2$ vertices and $L^2$ plaquettes, but each family has exactly one dependency (the product of all $A_v$ is the identity, and likewise all $B_p$ ), giving $(L^2-1)+(L^2-1)=2L^2-2$ independent generators. Hence $k=n-(2L^2-2)=\mathbf{2}$ logical qubits, independent of $L$ . Two logical qubits.

Step 3. Distance. A logical operator is a non-contractible loop of $X$ or $Z$ around the torus, and the shortest such loop has length $L$ , so $d=L$ . Degeneracy makes the code highly forgiving — many equivalent errors share a syndrome — but the distance is exactly $L$ , not merely bounded by it. $d=L$ .

Step 4. Evaluate at $L=3$ : $n=2\cdot 9=18$ , $k=2$ , $d=3$ , giving a $\mathbf{[[18,2,3]]}$ code. It corrects any single-qubit error using $2\cdot 9-2=16$ local checks, and — being CSS — decodes its $X$ and $Z$ errors with two independent minimum-weight matching runs. $[[18,2,3]]$ , the concrete face of "surface codes are CSS."

Physics of the portrait

CSS codes carry three names — Calderbank, Shor, and Steane — for two independent 1996 discoveries that turned out to be the same construction. Andrew Steane approached it from the physics of interference and gave the field its canonical worked example.

Origins · 1 minAndrew Steane and how this was discovered

Andrew Steane

born 1965, British physicist · quantum error correction and ion-trap computing

Andrew Martin Steane, a physicist at the University of Oxford, arrived at quantum error correction from atomic physics and multiple-particle interference rather than from classical coding theory. In 1996, in "Multiple particle interference and quantum error correction" (Proc. R. Soc. A 452, 2551) and "Error correcting codes in quantum theory" (Phys. Rev. Lett. 77, 793), he showed that a quantum code could be assembled from a classical binary code containing its own dual, using the code to protect amplitudes and its dual to protect phases — the seven-qubit $[[7,1,3]]$ code now bearing his name, built from the $[7,4,3]$ Hamming code. At almost the same moment Robert Calderbank and Peter Shor, working from the classical theory of good codes, proved that random dual-containing codes yield quantum codes with provably nonzero asymptotic rate and distance ("Good quantum error-correcting codes exist," Phys. Rev. A 54, 1098). The two results were quickly recognized as one recipe, and the acronym CSS — Calderbank–Shor–Steane — was born. Within a year Gottesman's stabilizer formalism revealed CSS codes as a transparent subclass of stabilizer codes, and the Steane code became, and remains, the code through which most students first meet fault-tolerant gates — its transversal Clifford group a direct consequence of the self-duality Steane exploited. He went on to lead trapped-ion quantum-computing experiments at Oxford, keeping one foot in the theory and the other in the hardware that must run it.

History

1996

— Calderbank and Shor prove good quantum codes exist by importing classical linear codes

1996

— Steane independently builds quantum codes from dual-containing codes and the seven-qubit code

1997

— Gottesman's stabilizer formalism recasts CSS codes as a transparent stabilizer subclass

1997

— Kitaev introduces the toric code, the first topological CSS code

2024

— a CSS surface code is driven below threshold on a superconducting processor

Going further

Texts. Nielsen and Chuang, Quantum Computation and Quantum Information, §10.4.2–10.4.3 (CSS codes and the Steane code) · Preskill, Lecture Notes for Physics 219, Ch. 7 (Quantum Error Correction) · Watrous, The Theory of Quantum Information, error-correction chapter · Wilde, Quantum Information Theory, Ch. 10 (Stabilizer and CSS codes) · Kitaev, Shen and Vyalyi, Classical and Quantum Computation, §15 · Gottesman, Stabilizer Codes and Quantum Error Correction (PhD thesis, 1997).

Provenance. The construction and parameters are standard: the originals are Calderbank and Shor, Phys. Rev. A 54, 1098 (1996), and Steane, Phys. Rev. Lett. 77, 793 (1996) and Proc. R. Soc. A 452, 2551 (1996). A verifier should: (1) confirm the symplectic rule reduces to $H_X H_Z^{T}=0$ and that this equals $C_2\subseteq C_1$ via $(C_1^{\perp})^{\perp}=C_1$ ; (2) recompute $HH^{T}=0\pmod 2$ for the $[7,4,3]$ Hamming matrix from the explicit row weights ( $4$ ) and overlaps ( $2$ ), giving the $[[7,1,3]]$ Steane code with $k=k_1-k_2=4-3=1$ ; (3) verify $k=k_1-k_2$ from Lagrange's theorem on $C_2\le C_1$ and $d\ge\min(d(C_1),d(C_2^{\perp}))$ from the coset representatives of the logicals; (4) check the toric-code counts $n=2L^2$ , $k=2$ , $d=L$ , giving $[[18,2,3]]$ at $L=3$ . The below-threshold surface-code result is the Google Quantum AI Nature 2024 demonstration; the good-quantum-LDPC constructions are Panteleev–Kalachev (2022) and Leverrier–Zémor (2022).

Builds on: Stabilizer Formalism · Pauli Group and Clifford Group · Discretization of Errors · Shor Nine-Qubit Code · Code Distance and Logical Operators. Leads to: Steane Seven-Qubit Code · Syndrome Measurement and Decoding · Quantum Hamming and Singleton Bounds.

Ask the tutor: hand me any two nested classical codes, or a lattice, and I will build the CSS code, verify $H_X H_Z^{T}=0$ , and read off its $[[n,k,d]]$ , logical operators, and transversal gate set.

What exactly makes a stabilizer code a CSS code?

A general stabilizer code is a set of commuting Pauli operators that may freely mix $X$ and $Z$ on the same qubit. A CSS code is the special case in which the generators can be chosen so each is purely $X$ -type or purely $Z$ -type. That single restriction is what lets you read the code off two classical binary codes, decode the $X$ and $Z$ errors independently, and inherit the transversal CNOT. Not every stabilizer code is CSS — the five-qubit $[[5,1,3]]$ code is not — but the most useful ones (Steane, surface, color, and good quantum LDPC codes) all are.

Why is it C₂ ⊆ C₁ and not the other way around?

The direction is fixed by which code guards which error. The parity checks of $C_1$ are the $Z$ -stabilizers that detect bit-flip ( $X$ ) errors, so undetectable $X$ -errors are the words of $C_1$ and the logical $X$ operators are those not already stabilizers — the difference $C_1\setminus C_2$ . For that to be well-defined, $C_2$ must sit inside $C_1$ . The phase protection comes symmetrically from $C_2^{\perp}$ . Reverse the inclusion and the two check families stop commuting: you no longer have a stabilizer code at all.

Is the Steane code the smallest CSS code, or just the most famous?

It is the smallest distance-3 CSS code and the most famous, but not the smallest quantum code correcting one error. The $[[5,1,3]]$ perfect code reaches distance $3$ on five qubits, but it is not CSS — its stabilizers mix $X$ and $Z$ , so it lacks the clean separation and the transversal Hadamard. The Steane code pays two extra qubits for that separation and is rewarded with a full transversal Clifford group and independent $X/Z$ decoding — the simplest code where fault-tolerant Clifford gates are essentially free.

Why can't a CSS code have a transversal T gate?

Transversal gates are limited to the Clifford group: the Eastin–Knill theorem forbids any code from having a transversal universal gate set, and the transversal logicals respecting the $X$ / $Z$ split of a CSS code are Clifford. The $T$ gate is the non-Clifford gate that, added to $\{H,S,\mathrm{CNOT}\}$ , makes the set universal, so it cannot be transversal on the Steane or surface codes. The workaround is magic-state distillation — purifying noisy $T$ -eigenstates with Clifford operations, then consuming a clean one to apply $T$ — and the distillation circuits are themselves CSS codes.

How are surface codes CSS codes?

The surface code puts a qubit on every edge of a two-dimensional lattice. Its stabilizers are the star operators (a product of Pauli- $X$ around each vertex) and the plaquette operators (a product of Pauli- $Z$ around each face). Because the stars are purely $X$ -type and the plaquettes purely $Z$ -type, the stabilizer group has exactly the CSS split, and the commutation $H_X H_Z^{T}=0$ is the topological identity $\partial_1\partial_2=0$ . This is why surface codes decode $X$ and $Z$ errors with two independent matching algorithms, and why the whole CSS language transfers — with logical operators appearing as non-contractible loops.

Does the distance bound d ≥ min(d(C₁), d(C₂⊥)) ever fail to be tight?

Yes, and usefully so. The bound is a floor, and degenerate CSS codes routinely beat it. Degeneracy means distinct errors share a syndrome and act identically on the code space, so many low-weight errors are harmless because they differ only by a stabilizer. The surface code is the standard example: its classical distances are modest, yet its true quantum distance equals the shortest non-contractible loop and its threshold is far higher than the raw bound suggests. Computing the real distance means searching over logical operators dressed by all stabilizers.

Why build a quantum code out of classical codes at all?

Because it reuses a century of classical coding theory instead of reinventing it. Classical linear codes come with parity-check matrices, dual codes, distance bounds, and fast decoders (belief propagation, minimum-weight matching), and CSS imports all of them wholesale: known classical distances bound the quantum distance, known decoders decode the two error types, and known asymptotic families (Gilbert–Varshamov, expander LDPC) yield good quantum codes. Designing commuting Pauli stabilizers from scratch throws that away. CSS is the bridge that makes quantum error correction an application of classical coding.