Shor Nine-Qubit Code

In 1995 quantum computing faced an objection that looked fatal. Classical machines fight noise by copying a bit many times and voting, but the no-cloning theorem forbids copying an unknown quantum state, and every measurement disturbs the thing it reads. If you cannot copy and cannot look, how could you ever protect a qubit? Peter Shor's nine-qubit code is the explicit answer — the first quantum error-correcting code, and a constructive proof that the objection is wrong. It encodes one logical qubit into nine physical qubits so that an arbitrary error on any single physical qubit — not merely a discrete bit flip $X$ or phase flip $Z$ , but any operator on that qubit, including coherent over-rotations and amplitude damping — can be detected and reversed without ever measuring, or disturbing, the logical information. The construction is a two-layer sandwich. The three-qubit bit-flip code beats $X$ errors by majority vote but is blind to $Z$ ; its Hadamard-conjugate, the phase-flip code, beats $Z$ but is blind to $X$ . Neither alone is a genuine quantum code. Shor's move was to concatenate them: take the phase-flip code on the outside and re-encode each of its qubits with a bit-flip block on the inside. The nested code inherits both protections at once, and because errors discretize, correcting the Pauli set on each qubit is enough to correct the entire continuum. Two ideas that were each half a code become, when stacked, the whole of one — the gateway to the stabilizer formalism, CSS codes, and the threshold theorem that makes scalable quantum computing possible.

Key takeaways

The Shor nine-qubit code is the first quantum error-correcting code: it encodes one logical qubit in nine physical qubits so that an arbitrary error on any single qubit can be detected and corrected.
It is built by concatenation — the three-qubit phase-flip code on the outside, each of its qubits re-encoded by a three-qubit bit-flip code — giving a $[[9,1,3]]$ stabilizer code.
Because errors discretize, correcting the Paulis $\{X,Z,Y=iXZ\}$ on each qubit automatically corrects every continuous single-qubit error, amplitude damping and small rotations included.
Bit flips are caught by six $ZZ$ stabilizers comparing qubits inside each block; phase flips are caught by two weight-six $X$ stabilizers comparing the relative sign of the blocks.
It has distance $d=3$ and corrects $t=1$ error; the minimal logical operators are $\bar X\simeq Z_1Z_4Z_7$ and $\bar Z\simeq X_1X_2X_3$ , both weight three.
It is a (highly redundant) CSS and degenerate code — the pedagogical ancestor of the leaner five-qubit and Steane seven-qubit codes and of the surface codes running on hardware today.
Key idea: concatenate phase-flip protection (the outer code, against $Z$ ) with bit-flip protection (the inner blocks, against $X$ ); because $Y=iXZ$ , correcting independent $X$ and $Z$ errors automatically corrects $Y$ , and by discretization this covers every single-qubit error.

Where this lives today

The Shor code itself is too redundant for a modern processor, but its ideas are the working vocabulary of every quantum error-correction experiment. Its direct descendant, the nine-qubit Bacon–Shor code — a subsystem variant of the same $3\times3$ layout — was run fault-tolerantly on thirteen trapped-ion qubits by the Maryland group (Egan et al., Nature 598, 281 (2021)), demonstrating an encoded logical qubit whose error rate fell below that of its physical constituents. The concatenation idea Shor introduced, recursively nesting a code inside itself to drive the logical error rate down as a double-exponential in the number of levels, is the engine behind the threshold theorem: below a critical physical error rate, arbitrarily long computations become reliable. Today the field has largely moved from concatenated codes to topological surface codes, which are also CSS and also degenerate but are laid out on a two-dimensional lattice with only local checks — Google's superconducting processors have shown a distance-five and then a distance-seven surface-code logical qubit whose error rate decreases as the code grows (the below-threshold result of Nature 2024), the scaling behaviour Shor's construction first made conceivable. Every one of these systems measures stabilizers exactly as the nine-qubit code taught: joint parities read by ancilla qubits, never touching the logical information, digitizing continuous noise into a discrete Pauli that a lookup table corrects.

The physical picture

Protect a secret two ways at once. The bit-flip code writes the same bit into three qubits so a single flip loses a majority vote in the computational basis; the phase-flip code does the identical thing in the $\{|+\rangle,|-\rangle\}$ basis, where a $Z$ error looks like a bit flip. A physical qubit can suffer both kinds of damage, so Shor simply stacks the two protections — three copies of a three-copy code — and gets robustness in both bases simultaneously. The outer layer decides which block carries a phase error; each inner block decides which qubit inside it carries a bit-flip error. The first figure draws that layered architecture: an outer phase-flip code whose three "qubits" are themselves bit-flip blocks.

Figure

The concatenation architecture: one logical qubit is encoded by the outer three-qubit phase-flip code into three blocks, and each block is re-encoded by the inner three-qubit bit-flip code into a GHZ-like triple, giving nine physical qubits arranged in a three by three grid; six ZZ checks act inside the blocks to catch bit flips and two weight-six X checks act between blocks to catch phase flips

Why does a finite set of discrete corrections defeat a continuum of possible errors? The answer is linearity plus measurement. An arbitrary error on qubit $i$ is a complex combination of the four Paulis $I,X,Y,Z$ acting there. When you measure the eight stabilizers you do not read the logical state — you read only relations between qubits — and that measurement projects the corrupted superposition onto one definite Pauli branch, "collapsing" the continuous error into a discrete one. A fixed Pauli recovery, chosen by the syndrome, then restores the codeword exactly; the continuous error parameters are never needed and never learned. The second figure makes this concrete with real syndrome bits: it tabulates the syndromes that specific single-qubit errors produce, and shows how two errors can conspire to a silent logical fault.

Figure

Concrete syndromes for the Shor code: an X on qubit 1 lights the block-A bit-flip checks as 1,0 while leaving the phase checks at 0,0; a Z on qubit 1 leaves the bit checks at 0 and lights the phase checks 1,0; a Y on qubit 5 lights bit checks 1,1 in block B and phase checks 1,1; and two Z errors on qubits 1 and 4 give phase syndrome 0,1 that a decoder mistakes for a block-C flip, so recovering block C completes the weight-three logical operator Z1 Z4 Z7

Read across the third block-tuple of the bit-flip syndrome as "which qubit inside the block," and across the two phase bits as "which block." The last row is the whole point of the distance: two well-placed errors reach a weight-three logical operator, and no code of distance three can see that coming.

The core equations

The logical basis states are the concatenation written out in full: each of the three blocks is a GHZ-like triple $|000\rangle\pm|111\rangle$ , and the outer sign encodes the logical bit. Everything else — stabilizers, logical operators, distance — follows from reading these two states.

|0\rangle_L=\frac{1}{2\sqrt{2}}\,(|000\rangle+|111\rangle)\otimes(|000\rangle+|111\rangle)\otimes(|000\rangle+|111\rangle) \qquad (1)

where: $|0\rangle_L$ — the encoded logical zero on nine qubits; $|000\rangle+|111\rangle$ — one inner bit-flip block, an unnormalized $\sqrt2\,|+\rangle$ in the outer phase-flip layer; $1/(2\sqrt2)=2^{-3/2}$ — normalization, since each block has norm $\sqrt2$ and there are three of them, $(\sqrt2)^3=2\sqrt2$ . Read it as three GHZ triples glued with plus signs. The logical one flips every outer sign to minus. That single sign flip, applied to all three blocks at once, is exactly the logical $X$ operation of the code, as we verify below.

|1\rangle_L=\frac{1}{2\sqrt{2}}\,(|000\rangle-|111\rangle)\otimes(|000\rangle-|111\rangle)\otimes(|000\rangle-|111\rangle) \qquad (2)

where: $|000\rangle-|111\rangle$ — the "minus" block, encoding the outer logical $|-\rangle$ of the phase-flip code. Note $\langle 0|1\rangle_L=0$ : the blocks are orthogonal because $\langle 000|111\rangle=0$ , so the two logical states are perfectly distinguishable in principle yet inaccessible to any single-qubit measurement. The codespace is the simultaneous $+1$ eigenspace of eight independent, mutually commuting stabilizer generators: six two-body $ZZ$ operators comparing qubits inside each block, and two six-body $X$ operators comparing the relative sign between blocks. This clean split into $Z$ -type and $X$ -type checks is the defining CSS structure.

\mathcal{S}=\langle\, Z_1Z_2,\,Z_2Z_3,\;Z_4Z_5,\,Z_5Z_6,\;Z_7Z_8,\,Z_8Z_9,\;X_1X_2X_3X_4X_5X_6,\;X_4X_5X_6X_7X_8X_9\,\rangle \qquad (3)

where: $Z_iZ_j$ — compares two qubits within a block, detecting bit flips ( $X$ errors); $X_1\cdots X_6$ and $X_4\cdots X_9$ — compare adjacent blocks, detecting phase flips ( $Z$ errors); $\langle\cdot\rangle$ — the abelian group generated by these eight Paulis. Any $X$ -type generator overlaps any $Z$ -type generator on an even number of qubits, so all eight commute and can be measured together; eight independent generators on nine qubits leave $9-8=1$ logical qubit. The logical operators live in the normalizer $N(\mathcal S)$ but outside $\mathcal S$ . Strikingly, logical $X$ is built from $Z$ 's and logical $Z$ from $X$ 's — the fingerprint of the concatenation, in which "flip the outer sign" ( $\bar X$ ) is a $Z$ -type operation and "read the outer sign" ( $\bar Z$ ) is an $X$ -type one.

\bar X = Z_1Z_2\cdots Z_9 \simeq Z_1Z_4Z_7,\qquad \bar Z = X_1X_2\cdots X_9 \simeq X_1X_2X_3 \qquad (4)

where: $\bar X$ — logical Pauli- $X$ , swapping $|0\rangle_L\leftrightarrow|1\rangle_L$ ; the canonical form $Z^{\otimes 9}$ reduces modulo stabilizers to the weight-three $Z_1Z_4Z_7$ (one $Z$ per block); $\bar Z$ — logical Pauli- $Z$ , applying a relative phase; $X^{\otimes 9}$ reduces to the weight-three $X_1X_2X_3$ ( $X$ on one full block). The symbol $\simeq$ means "equal up to a stabilizer," which does not change the action on the codespace. They anticommute, $\bar X\bar Z=-\bar Z\bar X$ , as a logical Pauli pair must. Counting these weights gives the code's headline parameters. The distance is the minimum weight over all nontrivial logical operators, and here that minimum is three, so the code corrects one arbitrary single-qubit error.

[[n,k,d]]=[[9,1,3]],\qquad t=\left\lfloor\frac{d-1}{2}\right\rfloor=\left\lfloor\frac{2}{2}\right\rfloor=1 \qquad (5)

where: $n=9$ — physical qubits; $k=1$ — logical qubits ( $=n$ minus the eight generators); $d=3$ — code distance, the lightest logical operator's weight; $t=1$ — arbitrary single-qubit errors correctable. The five-qubit perfect code achieves the same $t=1$ with $[[5,1,3]]$ , so the Shor code is deliberately redundant — its transparency, not its efficiency, is the point. Finally, the abstract criterion that certifies all of this is the Knill–Laflamme condition. It is the exact, if-and-only-if statement of when a set of errors is correctable, and the Shor code satisfies it for every weight- $\le 1$ Pauli.

\langle \bar i|\,E_a^\dagger E_b\,|\bar j\rangle = C_{ab}\,\delta_{ij} \qquad (6)

where: $|\bar i\rangle,|\bar j\rangle$ — the logical basis states $|0\rangle_L,|1\rangle_L$ ; $E_a,E_b$ — correctable errors, here all Paulis of weight $\le 1$ ; $C_{ab}$ — a Hermitian matrix independent of the logical labels $i,j$ ; $\delta_{ij}$ — Kronecker delta. The $\delta_{ij}$ says different errors never leak information distinguishing $|0\rangle_L$ from $|1\rangle_L$ ; the $i,j$ -independence of $C_{ab}$ says the errors deform both logical states identically. Degeneracy shows up as a singular $C_{ab}$ — several errors sharing a syndrome — which the Shor code has and which does no harm.

Derivation ABuilding the nine-qubit code by concatenating two three-qubit codes

The goal is to construct the Shor code from the ground up as an outer phase-flip code whose three qubits are each replaced by an inner bit-flip block, and to show that this nesting produces a genuine quantum code — one that corrects both $X$ and $Z$ on any single qubit — where each three-qubit layer alone corrects only one error type and is not a quantum code at all. We build the encoding map layer by layer and read off why the eight stabilizers take the form they do.

Step 1. Start with the outer three-qubit phase-flip code, which encodes $|0\rangle_L\mapsto|{+}{+}{+}\rangle$ and $|1\rangle_L\mapsto|{-}{-}{-}\rangle$ and is stabilized by $X_AX_B$ and $X_BX_C$ on its three qubits $A,B,C$ . Why: the phase-flip code is the Hadamard transform of the bit-flip code, so it corrects a single $Z$ (which is a bit flip in the $\pm$ basis) but is completely blind to $X$ — it is only half a code.

Step 2. Replace each outer qubit by an inner three-qubit bit-flip block through $|+\rangle\mapsto\frac{1}{\sqrt2}(|000\rangle+|111\rangle)$ and $|-\rangle\mapsto\frac{1}{\sqrt2}(|000\rangle-|111\rangle)$ . Substituting into Step 1 gives exactly equations (1) and (2). Why: the inner code corrects a single $X$ inside each block by majority vote, patching the outer code's blind spot without disturbing its phase protection.

Step 3. Lift the stabilizers. Each inner block contributes its two bit-flip checks $Z_1Z_2,Z_2Z_3$ (and the analogues on blocks B, C), giving six $Z$ -type generators. Why: a bit flip inside a block changes the parity of neighbouring qubits, which is precisely what the two $ZZ$ operators per block read out — three qubits, two independent parities, exactly enough to locate one flip.

Step 4. Lift the outer $X$ checks. The outer $X_A$ acting on a $\pm$ qubit becomes $X_1X_2X_3$ on its block (it flips $|000\rangle\pm|111\rangle$ into itself up to the sign it is testing), so $X_AX_B\mapsto X_1\cdots X_6$ and $X_BX_C\mapsto X_4\cdots X_9$ . Why: comparing the relative sign of two blocks requires flipping all six of their qubits at once, which is why the phase checks are weight-six rather than weight-two.

Step 5. Collect: six $ZZ$ plus two weight-six $X$ generators, all commuting, eight independent operators stabilizing a two-dimensional space. A single $X$ error is caught by the inner $ZZ$ checks of its block; a single $Z$ error is caught by the outer $X$ checks; a single $Y=iXZ$ trips both. Why: because the two error types are read by disjoint check types, the two layers of protection do not interfere, and the concatenated code corrects what neither layer could alone. *Note: each of the nine single-qubit Paulis $X_i,Z_i,Y_i$ yields a nonzero syndrome on the eight generators — confirming that every single-qubit error is detectable and that the encoding reproduces equations (1)–(3).*

Go deeper · Derivation B · 2 minCorrecting an arbitrary single-qubit error by discretization

Derivation BCorrecting an arbitrary single-qubit error by discretization

The goal is to prove the property that makes the Shor code a true quantum code and not merely a corrector of discrete flips: the ability to reverse the three Paulis $X,Y,Z$ on each qubit implies the ability to reverse any single-qubit operation on that qubit, including non-unitary noise such as amplitude damping and coherent over-rotations, even though those errors form a continuum. We take a general error, apply it to a codeword, and trace it through the syndrome measurement to see the continuum collapse to a discrete choice.

Step 1. Expand the error. Any linear operator on qubit $i$ is a combination of the four Paulis, $E=e_I I + e_X X_i + e_Y Y_i + e_Z Z_i$ , because $\{I,X,Y,Z\}$ spans the space of $2\times2$ matrices. Why: this is the algebraic heart of the argument — a continuous, possibly non-unitary error lives in a four-dimensional space with a discrete Pauli basis.

Step 2. Apply it to a codeword. Linearity gives $E|\psi\rangle = e_I|\psi\rangle + e_X X_i|\psi\rangle + e_Y Y_i|\psi\rangle + e_Z Z_i|\psi\rangle$ , a superposition of four branches, one per Pauli. Why: the corrupted state is not "a little bit wrong" in some fuzzy way — it is a coherent sum of four cleanly-labelled error branches.

Step 3. Measure the eight stabilizers. On qubit $i$ the operators $I_i,X_i,Y_i,Z_i$ carry distinct syndromes (up to the harmless block degeneracy), so the measurement projects the superposition onto a single branch with probability $|e_P|^2$ , yielding a definite Pauli error $P_i|\psi\rangle$ and its syndrome. Why: stabilizer measurement is a projective measurement in the "error basis," and it collapses the continuous coefficients into one discrete outcome — you learn which Pauli, never the amplitudes.

Step 4. Recover. Knowing the syndrome fixes the Pauli $P$ ; applying $P_i^\dagger$ gives $P_i^\dagger(P_i|\psi\rangle)=|\psi\rangle$ , the exact codeword. Why: Paulis are self-inverse up to phase, so the recovery is a single fixed gate, and the state is restored perfectly with no residual dependence on $e_P$ .

Step 5. Conclude for channels. Writing a general noise channel as $\mathcal E(\rho)=\sum_k E_k\rho E_k^\dagger$ with each $E_k$ supported on one qubit, every Kraus branch is corrected by the argument above, so $\mathcal E$ restricted to single-qubit support is corrected exactly. Why: correctness for each Pauli, plus linearity, upgrades automatically to correctness for arbitrary — including dissipative — single-qubit noise.

E|\psi\rangle=\sum_{P\in\{I,X,Y,Z\}} e_P\,P_i|\psi\rangle \;\xrightarrow{\text{measure } \mathcal S}\; P_i|\psi\rangle \;\xrightarrow{\;P_i^\dagger\;}\;|\psi\rangle

The substance of this argument is the orthogonality of single-qubit Pauli syndromes, which can be confirmed by commuting each of $X_i,Y_i,Z_i$ against the eight generators.

Go deeper · Derivation C · 2 minThe distance is exactly three

Derivation CThe distance is exactly three

The goal is to prove that the minimum weight of a nontrivial logical operator is three, which fixes $d=3$ and hence $t=1$ , and to exhibit the lightest logical operators explicitly — correcting a common error that mislabels $Z_1Z_2Z_3$ as a logical operator when it is in fact a detectable error. A logical operator must commute with all eight stabilizers (so it is undetectable) yet lie outside $\mathcal S$ (so it acts nontrivially on the codespace); we hunt for the lightest such Pauli.

Step 1. No weight-one logical exists. Every single-qubit Pauli is detected: $X_i$ or $Y_i$ anticommutes with a $ZZ$ check of its block, and $Z_i$ anticommutes with a weight-six $X$ check (a single $Z$ overlaps $X_1\cdots X_6$ on one qubit, an odd count). So $d>1$ . Why: with a nonzero syndrome, a weight-one error is caught and corrected, so it can never be a silent logical operation.

Step 2. No weight-two logical exists. A representative trap is $Z_1Z_2Z_3$ — it is not weight two, but it illustrates the check: $Z_1Z_2Z_3$ overlaps $X_1\cdots X_6$ on three qubits, an odd count, so it anticommutes and is detected, not logical. Genuine weight-two Paulis are likewise caught: for instance $Z_1Z_4$ overlaps $X_4\cdots X_9$ on the single qubit 4 and so anticommutes with it. Every weight-two Pauli triggers some generator. So $d>2$ . Why: distance is about undetectable operators, and an odd overlap with any generator means detection — light Paulis cannot hide.

Step 3. A weight-three logical exists — logical $Z$ . Take $\bar Z\simeq X_1X_2X_3$ : it commutes with every $ZZ$ check (overlapping $Z_1Z_2$ on qubits 1,2 and $Z_2Z_3$ on qubits 2,3, each an even count) and with both $X$ checks trivially, yet equals $X^{\otimes 9}$ modulo the stabilizer $X_4\cdots X_9$ , so it is a nontrivial logical of weight three. Why: flipping one whole block's phase reference is undetectable because it respects every parity check, but it is exactly the logical $Z$ action on the outer code.

Step 4. A weight-three logical exists — logical $X$ . Take $\bar X\simeq Z_1Z_4Z_7$ , one $Z$ per block: it overlaps each weight-six $X$ check on exactly two qubits (even, hence commuting) and commutes with all $Z$ checks, yet equals $Z^{\otimes 9}$ modulo three $ZZ$ stabilizers. Why: this is the two-error failure mode made honest — two of its three $Z$ 's are the uncorrectable pair $Z_1,Z_4$ , and the third completes the silent logical bit flip.

Step 5. Conclude. Both nontrivial logicals reach minimum weight three and none is lighter, so $d=3$ and $t=\lfloor(3-1)/2\rfloor=1$ : exactly one arbitrary single-qubit error is guaranteed correctable. Why: distance three is the smallest distance that corrects a full error, and it is the price of the Shor code's simplicity.

d=\min_{L\in N(\mathcal S)\setminus\mathcal S}\operatorname{wt}(L)=\operatorname{wt}(X_1X_2X_3)=\operatorname{wt}(Z_1Z_4Z_7)=3

One can confirm $d=3$ by enumerating all weight- $\le2$ Paulis on nine qubits against the eight generators — every one has a nonzero syndrome — and then exhibiting the weight-three normalizer elements $X_1X_2X_3$ and $Z_1Z_4Z_7$ . Note that $Z_1Z_2Z_3$ is detected, not logical.

Limiting cases

Pushing the code into special regimes sharpens exactly what "single-error correction" buys and what it does not.

Case	Result	Meaning
Single Pauli error	$E\in\{X_i,Y_i,Z_i\},\ i=1,\dots,9$	Perfectly corrected: each yields a definite (or harmlessly degenerate) syndrome and a unique recovery Pauli.
Arbitrary single-qubit error	$E_i=\alpha I+\beta X_i+\gamma Y_i+\delta Z_i$	Corrected by discretization: the syndrome projects onto one Pauli branch and recovery is exact, independent of $\alpha,\beta,\gamma,\delta$ .
Two phase errors, different blocks	$Z_1Z_4\Rightarrow$ phase syndrome $(0,1)$	Uncorrectable: mis-decoded as a block-C flip, recovery $Z_7$ completes $Z_1Z_4Z_7=\bar X$ — a silent logical bit flip, since $d=3$ .
Phase-flip degeneracy	$Z_1,Z_2,Z_3$ : same syndrome, same action	The three intra-block $Z$ 's share syndrome $(1,0)$ and act identically on the codespace; the code is degenerate and the ambiguity is harmless.
Correlated two-qubit error inside a block	$X_1X_2$	Detected but miscorrected: syndrome matches $X_3$ , recovery gives $X_1X_2X_3=\bar Z$ — beyond the $t=1$ guarantee.

Common trapThe code corrects an arbitrary error on ONE qubit, not every error on every qubit

The single most common misconception is that a nine-qubit code corrects nine qubits' worth of errors. It corrects an arbitrary error on at most one physical qubit. Two independent errors can defeat it: a $Z$ on qubit 1 and a $Z$ on qubit 4 produce phase syndrome $(0,1)$ , which the decoder reads as a lone phase flip on block C and "corrects" with a $Z$ on block C — completing the weight-three logical operator $Z_1Z_4Z_7=\bar X$ and silently flipping the logical qubit. A second, subtler trap: do not assume $Z_1Z_2Z_3$ is a logical operator because it is confined to one block. It overlaps the check $X_1X_2X_3X_4X_5X_6$ on three qubits (odd), so it anticommutes — it is a detectable error, not a member of the normalizer. Only operators with an even overlap on every generator are logical, and the lightest of those have weight three.

Worked examples

1 · Correcting a Y error on qubit 5 (fully worked)

A phase-and-bit error $Y_5=iX_5Z_5$ strikes the middle qubit of the middle block. Compute the six-bit bit-flip syndrome and the two-bit phase syndrome, and state the recovery.

Step 1. Split the error. $Y_5=iX_5Z_5$ is simultaneously a bit flip and a phase flip on qubit 5, so it will trip both the $Z$ -type and the $X$ -type checks. Handle the two parts separately. Y₅ = i·X₅·Z₅.

Step 2. Bit-flip syndrome from the $X_5$ part. Qubit 5 sits in block B, whose checks are $Z_4Z_5$ and $Z_5Z_6$ . $X_5$ anticommutes with both (it overlaps each on qubit 5, an odd count), and commutes with all checks in blocks A and C. The six-bit syndrome $(Z_1Z_2,Z_2Z_3\mid Z_4Z_5,Z_5Z_6\mid Z_7Z_8,Z_8Z_9)$ is therefore $(0,0\mid 1,1\mid 0,0)$ . Bit syndrome = (0,0 | 1,1 | 0,0), pinpointing qubit 5.

Step 3. Phase syndrome from the $Z_5$ part. $Z_5$ overlaps $X_1\cdots X_6$ on qubit 5 (odd, anticommute) and $X_4\cdots X_9$ on qubit 5 (odd, anticommute), so the two-bit phase syndrome $(X_1\!\cdots\!X_6,\,X_4\!\cdots\!X_9)$ is $(1,1)$ — the signature of a phase flip on block B. Phase syndrome = (1,1), pinpointing block B.

Step 4. Recover. The bit syndrome $(1,1)$ within block B uniquely identifies qubit 5, so apply $X_5$ . The phase syndrome $(1,1)$ identifies block B, so apply a single $Z$ to that block; by degeneracy $Z_4,Z_5,Z_6$ all act identically, so choose $Z_5$ . The combined recovery $X_5Z_5$ inverts $Y_5$ up to an irrelevant global phase, restoring the codeword exactly. Recovery = X₅ then Z₅ (any block-B qubit) ≡ Y₅⁻¹ — state restored.

2 · How two errors forge a logical fault

Errors $Z_1$ and $Z_4$ occur together. Show that the code fails, and identify the resulting logical operation.

Step 1. Bit-flip syndrome. Both are pure $Z$ errors, which commute with every $ZZ$ check, so the entire six-bit bit-flip syndrome is $(0,0\mid 0,0\mid 0,0)$ — no bit-flip alarm at all. Bit syndrome = all zeros.

Step 2. Phase syndrome of each error alone. $Z_1$ (block A) gives $(1,0)$ ; $Z_4$ (block B) gives $(1,1)$ . Since Pauli syndromes add mod 2, the combined phase syndrome is $(1,0)\oplus(1,1)=(0,1)$ . Combined phase syndrome = (0,1).

Step 3. Decoder's mistake. A phase syndrome of $(0,1)$ is exactly what a single phase flip on block C produces, so a minimum-weight decoder concludes "block C flipped" and applies a $Z$ to block C — say $Z_7$ . It cannot know two errors occurred; $(0,1)$ has weight-one and weight-two explanations, and it picks the lighter one. Decoder applies Z₇.

Step 4. The net effect. The true errors times the recovery give $Z_1\cdot Z_4\cdot Z_7=Z_1Z_4Z_7=\bar X$ , a weight-three logical operator. The syndrome is now clean, the decoder believes it succeeded, and the logical qubit has been silently bit-flipped. Net operation = Z₁Z₄Z₇ = X̄ — an undetected logical error, the hallmark of exceeding t = 1.

Physics of the portrait

The Shor code is where a young theorist turned a philosophical worry — that quantum information might be intrinsically unprotectable — into a concrete construction, one year after inventing the factoring algorithm that made protection urgent.

Origins · 1 minPeter Shor and how this was discovered

Peter Shor

born 1959, American mathematician · quantum algorithms and quantum error correction

Peter Williston Shor (born 14 August 1959) was a researcher at AT&T Bell Laboratories when, in 1994, he found the polynomial-time quantum algorithm for factoring integers that made large-scale quantum computing suddenly worth building — and made its fragility suddenly worth solving. Many believed the fragility was fatal: quantum states cannot be cloned, so the classical trick of redundant copies is unavailable, and any measurement to check for errors would collapse the very superposition being protected. In a 1995 paper, "Scheme for reducing decoherence in quantum computer memory" (Phys. Rev. A 52, R2493), Shor dissolved both objections at once. He showed that one can measure stabilizers — joint parities that reveal errors without revealing, or disturbing, the logical state — and that concatenating a phase-flip code with a bit-flip code yields a nine-qubit code correcting an arbitrary single-qubit error. Andrew Steane found a related seven-qubit code independently soon after, and within two years Calderbank, Shor, and Steane had the CSS family, Knill and Laflamme had the general correctability conditions, and Gottesman had the stabilizer formalism that revealed all these codes as one construction. Shor, later the Morss Professor of Applied Mathematics at MIT, received the Nevanlinna Prize, the Gödel Prize, and a MacArthur Fellowship; the nine-qubit code remains the canonical first example through which every student meets quantum error correction.

History

1995

— Shor publishes the nine-qubit code, the first quantum error-correcting code

1996

— Steane's seven-qubit CSS code and the five-qubit perfect code appear

1996

— Calderbank, Shor and Steane introduce the CSS code family

1997

— Knill and Laflamme give the general conditions for a correctable code

1997

— Gottesman's stabilizer formalism unifies these codes as one construction

2021

— the nine-qubit Bacon-Shor code is run fault-tolerantly on trapped ions

Going further

Texts. Nielsen and Chuang, Quantum Computation and Quantum Information, §10.2 (Shor code) and §10.3 (discretization) · Preskill, Lecture Notes for Physics 219, Ch. 7 · Watrous, The Theory of Quantum Information, Ch. on error correction · Wilde, Quantum Information Theory, Ch. 24 · Kitaev, Shen and Vyalyi, Classical and Quantum Computation, §15 · Gottesman, Stabilizer Codes and Quantum Error Correction (PhD thesis, 1997). The eight generators mutually commute — every $X$ -type overlaps every $Z$ -type on an even number of qubits — and are independent, giving $k=9-8=1$ . The canonical logicals $\bar X=Z^{\otimes9}$ and $\bar Z=X^{\otimes9}$ commute with all stabilizers and anticommute with each other ( $(-1)^9=-1$ ), reducing to the weight-three representatives $Z_1Z_4Z_7$ and $X_1X_2X_3$ . Distance $d=3$ follows by exhausting all weight- $\le2$ Paulis against the generators (each has nonzero syndrome) and exhibiting those weight-three normalizer elements — noting that $Z_1Z_2Z_3$ is detected, not logical. The worked syndromes are $Y_5\to$ bit $(0,0\mid1,1\mid0,0)$ and phase $(1,1)$ , and $Z_1Z_4\to$ phase $(0,1)$ mis-decoded to $Z_1Z_4Z_7=\bar X$ . The Bacon–Shor trapped-ion result is Egan et al., Nature 598, 281 (2021).

Builds on: Three-Qubit Bit-Flip Code · Three-Qubit Phase-Flip Code · Discretization of Errors · Quantum Error Model and Decoherence Channels · Pauli Group and Clifford Group. Leads to: Stabilizer Formalism · CSS Codes · Steane Seven-Qubit Code · Knill–Laflamme Conditions · Syndrome Measurement and Decoding.

Ask the tutor: name any single-qubit Pauli on qubits 1 through 9 and I will compute its full six-bit and two-bit syndrome, give the recovery, and then show you a two-error pair that slips past the code as a logical fault.

Why does the Shor code need nine qubits when the five-qubit code corrects the same errors?

Because it trades efficiency for transparency. The five-qubit code is the perfect $[[5,1,3]]$ code, saturating the quantum Hamming bound: with $t=1$ it uses the fewest qubits any distance-three code possibly can. The Shor code uses nine because it is built by literally nesting two three-qubit codes, $3\times3=9$ , and that concatenated structure makes everything visible — the $Z$ -checks are the inner bit-flip votes, the $X$ -checks are the outer phase-flip votes, and logical $X$ and $Z$ read off the blocks by eye. The five-qubit code is more compact but its stabilizers mix $X$ and $Z$ on the same qubits and carry no such intuitive story. For learning, and historically, transparency won.

How can you detect an error without measuring — and collapsing — the qubit?

You never measure the qubits; you measure relations between them. Each stabilizer, like $Z_1Z_2$ , asks "do qubits 1 and 2 agree?" without asking what either value is. Its eigenvalue is $+1$ on the whole codespace, so measuring it on an uncorrupted codeword returns $+1$ and leaves the state untouched; an error that flips the agreement returns $-1$ and reveals that something went wrong without revealing the logical bit. This is the central trick of the entire field: the syndrome lives in the parities, which are unentangled with the logical information, so extracting it disturbs nothing you care about. The logical qubit's superposition survives intact through every round of checking.

What does it mean that the Shor code is degenerate?

Degenerate means distinct errors can share a syndrome and act identically on the codespace, so the decoder need not — and cannot — tell them apart. In the Shor code, a $Z$ on qubit 1, 2, or 3 all produce the same phase syndrome $(1,0)$ and all impose the same phase on block A, because they differ only by the stabilizers $Z_1Z_2,Z_2Z_3$ , which act trivially on codewords. The decoder applies one recovery, say $Z_1$ , and it correctly undoes whichever of the three actually happened. Far from a defect, degeneracy is a feature: it lets a code with relatively few stabilizers cover many physical errors, and it is one reason surface codes tolerate such high error rates.

Is the Shor code a CSS code, and why does that matter?

Yes. A CSS (Calderbank–Shor–Steane) code is one whose stabilizers split into a purely $X$ -type set and a purely $Z$ -type set, with no generator mixing the two — and the Shor code's six $ZZ$ checks and two weight-six $X$ checks do exactly that. This split matters because it decouples the two error types: $X$ errors are handled entirely by the $Z$ -checks and $Z$ errors entirely by the $X$ -checks, so the code is built from two independent classical linear codes, one for each basis. That structure makes CSS codes easy to construct, easy to analyze, and friendly to fault-tolerant gates; the Steane and surface codes are CSS too. The Shor code is the first and most redundant member of the family.

Why is logical X made of Z operators and logical Z made of X operators?

It looks backwards but it is the signature of the concatenation. The outer code is a phase-flip code, whose computational basis is $\{|+\rangle,|-\rangle\}$ . In that basis, the logical bit-flip $\bar X$ — the operation swapping $|0\rangle_L\leftrightarrow|1\rangle_L$ , i.e. $|{+}{+}{+}\rangle\leftrightarrow|{-}{-}{-}\rangle$ — is applied by $Z$ operators, since $Z$ swaps $|+\rangle\leftrightarrow|-\rangle$ . Conversely the logical phase $\bar Z$ , which distinguishes the two outer states, is read by $X$ operators. Concretely $\bar X\simeq Z_1Z_4Z_7$ places one $Z$ in each block, and $\bar Z\simeq X_1X_2X_3$ flips one whole block. The apparent role-reversal is just the Hadamard-transformed logic of the outer phase-flip layer showing through.

Does the Shor code protect a qubit indefinitely, or only for one round?

Only for one round of noise between corrections, and only against a single-qubit error within that round. To protect for a long time you repeat the cycle — apply noise, measure the eight stabilizers, decode, recover — many times, and the code keeps the logical error rate low provided at most one physical error accumulates per cycle. If the physical error rate per qubit per cycle is $p$ , the logical error rate scales like $p^2$ (two errors needed to cause a logical fault), a suppression only if $p$ is small. Fault tolerance then demands that the syndrome extraction itself be built from gadgets that do not spread one error into many; concatenating the code with itself and staying below the threshold is what turns single-round protection into indefinite protection.