Three-Qubit Bit-Flip Code

A qubit in a laboratory is a fragile thing: stray fields, control-pulse errors, and coupling to the environment all conspire to flip it. The three-qubit bit-flip code is the first honest answer to that fragility, and the natural doorway into the whole theory of quantum error correction. It confronts one restricted enemy — the bit-flip channel, in which each physical qubit independently suffers a Pauli $X$ error with probability $p$ — and defeats it by spreading a single logical qubit across three physical qubits in an entangled, redundant way. A lone flip can then be detected and reversed, and the logical error probability falls from $O(p)$ to $O(p^2)$ . The construction is modelled on the classical majority-vote repetition code $0\to000$ , $1\to111$ , yet two quantum commandments force a new design. First, the no-cloning theorem forbids copying an unknown state, so the encoded state $\alpha\lvert000\rangle+\beta\lvert111\rangle$ is emphatically not $\lvert\psi\rangle^{\otimes3}$ ; it is a coherent superposition assembled with two CNOTs. Second, checking for errors must never read the logical amplitudes $\alpha,\beta$ , or the qubit collapses. The escape is syndrome measurement: we measure only the parities $Z_1Z_2$ and $Z_2Z_3$ , which commute with the encoded data yet announce which qubit was flipped. Three deeper features follow — linearity, discretization of continuous errors, and the fact that the redundancy lives in correlations rather than copies. The code is one-sided (it does nothing against phase errors), but it is the miniature that instantiates the stabilizer formalism and forms half of Shor's nine-qubit code.

Key takeaways

Encode $\alpha\lvert0\rangle+\beta\lvert1\rangle$ into the entangled codeword $\alpha\lvert000\rangle+\beta\lvert111\rangle$ using two CNOTs — not three copies, which no-cloning forbids.
Diagnose errors by measuring the generators $Z_1Z_2$ and $Z_2Z_3$ ; their joint $\pm1$ eigenvalues form a two-bit syndrome that locates a flipped qubit without touching $\alpha,\beta$ .
The four syndromes $(+,+),(-,+),(-,-),(+,-)$ name the no-error case and the three flips $X_1,X_2,X_3$ uniquely, so any one bit flip is undone by reapplying the indicated $X$ .
Encoding wins whenever $p<1/2$ : the failure probability is $p_{\text{fail}}=3p^2-2p^3$ , quadratically small ( $\approx3p^2$ ) at low $p$ .
It is distance- $3$ against $X$ but blind to $Z$ (a single $Z_i$ is undetected, acting as logical $\bar Z$ ); Hadamard-conjugating it gives the phase-flip code, and concatenating the two gives Shor's nine-qubit code.
Key idea: encode $\alpha\lvert0\rangle+\beta\lvert1\rangle\to\alpha\lvert000\rangle+\beta\lvert111\rangle$ and measure the commuting parity checks $Z_1Z_2$ and $Z_2Z_3$ ; their joint eigenvalues form a syndrome that names the flipped qubit while leaving $\alpha,\beta$ untouched, so reapplying the matching $X$ restores the logical state.

Where this lives today

The three-qubit bit-flip code is no museum piece — its exact logic is what today's hardware teams run as their first real error-correction experiment. In 2021 Google's hardware group ran the repetition code — the bit-flip code's direct descendant, extended to 21 physical qubits at distance 11 — through many rounds of stabilizer measurement and reported exponential suppression of the logical bit-flip error as the code distance grew, exactly the $\approx(p/p_{\text{th}})^{d/2}$ scaling the $3p^2$ result foreshadows for $d=3$ . Because the repetition code corrects only one error type, it isolates and stress-tests the syndrome-extraction machinery — repeated parity measurement, leakage, correlated errors — before that machinery is trusted inside the surface code. That paid off: by 2023–2024 the same lineage pushed a surface-code logical qubit below threshold, so adding qubits lowered the logical error. Trapped-ion and neutral-atom machines run the same small codes with real-time decoding and mid-circuit measurement. Every one of these demonstrations begins, conceptually and often literally, with the encode–measure–correct cycle of the three-qubit bit-flip code.

The physical picture

Write the logical bit three times and take a majority vote — that is the classical repetition code, and the quantum code borrows its skeleton. The quantum twist is that you may not read the three bits to vote, because the qubit is in a superposition and reading would collapse it. Instead you ask only "do neighbours agree?" by measuring the parities $Z_1Z_2$ and $Z_2Z_3$ — enough to spot a single dissenter without learning whether the agreed value was 0 or 1. The codespace is the simultaneous $+1$ eigenspace of the two parity operators; an $X$ error on qubit $i$ anticommutes with whichever checks touch that qubit, flipping their eigenvalues to $-1$ . Because the three flips touch the checks differently, each leaves a distinct two-bit fingerprint — the syndrome — that names the qubit to repair. The first figure is the whole anatomy on one page.

Figure

The code anatomy: one logical qubit spread over three physical qubits as α·000 + β·111, with two parity checks Z₁Z₂ and Z₂Z₃ whose ± eigenvalues form the syndrome — each single bit-flip X₁ X₂ X₃ leaves a distinct fingerprint, (−,+), (−,−), (+,−)

The payoff is not that the code is clever but that it works, quantitatively. Because the decoder misjudges only when two or more qubits flip, the residual logical error scales as the square of the physical rate. The second figure plots $p_{\text{fail}}=3p^2-2p^3$ against the physical error rate, sitting well below the break-even diagonal until the two curves meet at $p=1/2$ . Left of that crossing, encoding is a net win; right of it, it makes matters worse.

Figure

Logical failure probability p_fail = 3p² − 2p³ versus the physical error rate p: the encoded curve in blue sits below the unencoded diagonal p in grey for every p < 0.5, meeting it at the break-even point p = 0.5; at p = 0.1 the logical error is 0.028, about 3.6× smaller than the bare 0.1

The core equations

The starting point is the codewords. We reserve a two-dimensional subspace of the eight-dimensional three-qubit Hilbert space for the logical qubit, choosing the two computational states maximally separated under bit flips.

\lvert0\rangle_L=\lvert000\rangle,\qquad \lvert1\rangle_L=\lvert111\rangle \qquad (1)

where: $\lvert0\rangle_L,\lvert1\rangle_L$ — logical basis states; $\lvert000\rangle,\lvert111\rangle$ — computational basis states of three physical qubits. Reading: the codespace is their span, so a general encoded qubit is $\alpha\lvert000\rangle+\beta\lvert111\rangle$ . Encoding an unknown qubit means mapping its amplitudes onto that codeword linearly — the encoder is a unitary, and two CNOTs do the job. What is copied is the basis label, never the amplitude, so no-cloning is respected.

\alpha\lvert0\rangle+\beta\lvert1\rangle \;\xrightarrow{\ \text{two CNOTs}\ }\; \alpha\lvert000\rangle+\beta\lvert111\rangle \qquad (2)

where: $\alpha,\beta$ — logical amplitudes with $|\alpha|^2+|\beta|^2=1$ ; the arrow is the isometric encoder $U_{\text{enc}}$ acting on the data qubit plus two ancillas in $\lvert0\rangle$ . Reading: the output is entangled, not a product — the crucial departure from classical repetition. Errors are detected by the stabilizer group: the abelian group of Pauli operators that fix every codeword. Two commuting generators suffice, and their common $+1$ eigenspace is the codespace.

\mathcal{S}=\langle\,Z_1Z_2,\;Z_2Z_3\,\rangle \qquad (3)

where: $\mathcal{S}$ — stabilizer group; $Z_iZ_j$ — two-qubit parity check, eigenvalue $+1$ iff qubits $i,j$ agree in the $Z$ basis. Reading: three qubits minus two generators leaves $3-2=1$ encoded qubit. The operators that move information within the codespace are the logical operators — Pauli strings that commute with every stabilizer but are not in $\mathcal{S}$ , obeying the same algebra as single-qubit $X$ and $Z$ .

\bar X=X_1X_2X_3,\qquad \bar Z=Z_1\ (\simeq Z_2\simeq Z_3) \qquad (4)

where: $\bar X$ — logical bit flip, exchanging $\lvert0\rangle_L\leftrightarrow\lvert1\rangle_L$ ; $\bar Z$ — logical phase flip, where any single $Z_i$ acts identically on the codespace. Reading: $\bar Z$ has weight one, so a single physical $Z$ is a logical fault. Measuring the two generators returns their eigenvalues, and this pair is the syndrome — nondestructive because the generators commute with $\bar X$ and $\bar Z$ .

s_1=\langle Z_1Z_2\rangle,\quad s_2=\langle Z_2Z_3\rangle,\qquad (s_1,s_2)\in\{+1,-1\}^2 \qquad (5)

where: $s_1,s_2$ — measured eigenvalues of the two generators. Reading: the four outcomes decode as $I\!\to\!(+,+)$ , $X_1\!\to\!(-,+)$ , $X_2\!\to\!(-,-)$ , $X_3\!\to\!(+,-)$ — a one-to-one dictionary. With independent bit flips at rate $p$ , the decoder fails exactly when two or three qubits flip. Binomial counting gives the logical failure probability.

p_{\text{fail}}=3p^2(1-p)+p^3=3p^2-2p^3 \qquad (6)

where: $p$ — per-qubit physical bit-flip probability; $p_{\text{fail}}$ — probability the decoded logical qubit is wrong. Reading: $p_{\text{fail}}<p$ precisely when $p<1/2$ , with leading behaviour $\approx3p^2$ — the quadratic suppression that justifies the scheme. A subtle worry is that physical noise is continuous. The channel can deposit a coherent over-rotation, which expands into a superposition of "no error" and "full $X$ ".

e^{-i\theta X_i}=\cos\theta\,I-i\sin\theta\,X_i \qquad (7)

where: $\theta$ — coherent rotation angle about the $x$ axis on qubit $i$ . Reading: syndrome measurement projects this superposition onto one branch or the other with probabilities $\cos^2\theta,\sin^2\theta$ — the continuum collapses to the two cases the code already handles. Finally, that a finite error set is correctable is certified by the Knill–Laflamme conditions, the master criterion of quantum error correction.

\langle\bar i\rvert E_a^{\dagger}E_b\lvert\bar j\rangle=C_{ab}\,\delta_{ij} \qquad (8)

where: $\lvert\bar i\rangle$ — logical basis states, $i,j\in\{0,1\}$ ; $E_a,E_b$ — correctable errors, here $\{I,X_1,X_2,X_3\}$ ; $C_{ab}$ — a Hermitian matrix independent of the logical indices. Reading: $\delta_{ij}$ says errors never leak information about $\alpha,\beta$ ; $C_{ab}$ says they are distinguishable — the two halves of correctability.

Derivation ABuilding the codeword with two CNOTs and stabilizing it

The goal is to show, line by line, that two controlled-NOT gates on a data qubit and two fresh ancillas produce exactly the entangled codeword $\alpha\lvert000\rangle+\beta\lvert111\rangle$ — not the forbidden three-copy state — and then to verify that the generators $Z_1Z_2$ and $Z_2Z_3$ genuinely fix that codeword, so the encoding lands in the intended $+1$ eigenspace. This ties the encoder, the codespace, and the stabilizer together, the scaffolding every later step rests on.

Step 1. Prepare the input $(\alpha\lvert0\rangle+\beta\lvert1\rangle)\otimes\lvert0\rangle\otimes\lvert0\rangle=\alpha\lvert000\rangle+\beta\lvert100\rangle$ : data qubit plus two ancillas in $\lvert0\rangle$ . Why: the ancillas start in a fixed known state, since the encoder is a fixed unitary and cannot depend on the secret $\alpha,\beta$ .

Step 2. Apply CNOT from qubit 1 to qubit 2: $\lvert10\dots\rangle\to\lvert11\dots\rangle$ gives $\alpha\lvert000\rangle+\beta\lvert110\rangle$ . Why: the gate copies qubit 1's basis label onto qubit 2, which looks like cloning but is not — a superposition input yields an entangled output, not two copies.

Step 3. Apply CNOT from qubit 1 to qubit 3, sending this to $\alpha\lvert000\rangle+\beta\lvert111\rangle=\lvert\psi_L\rangle$ . Why: the second CNOT completes the weight-three entangled codeword; trying $\lvert\psi\rangle^{\otimes3}$ instead would produce cross terms like $\alpha^2\beta\lvert001\rangle$ , outside the codespace.

Step 4. Verify $Z_1Z_2\lvert000\rangle=(+1)(+1)\lvert000\rangle=+\lvert000\rangle$ and $Z_1Z_2\lvert111\rangle=(-1)(-1)\lvert111\rangle=+\lvert111\rangle$ , and identically for $Z_2Z_3$ . Why: both codewords are $+1$ eigenstates of both generators, so by linearity every superposition $\alpha\lvert000\rangle+\beta\lvert111\rangle$ is stabilized — the encoder output sits in the common $+1$ eigenspace, confirming $\mathcal{S}$ defines this code. *Verified: the two CNOTs give $U_{\text{enc}}\lvert\psi,0,0\rangle=\alpha\lvert000\rangle+\beta\lvert111\rangle$ and both generators return $+1$ on both codewords, matching Nielsen and Chuang section 10.1.*

Go deeper · Derivation B · 1 minCorrecting a continuous single-qubit rotation

Derivation BCorrecting a continuous single-qubit rotation

The goal is to prove the discretization theorem in miniature: even a continuous over-rotation $e^{-i\theta X_1}$ — an error the code was never explicitly designed for — is corrected exactly, because syndrome measurement projects the continuum onto the two discrete cases the code does handle. This is the argument that rescues quantum error correction from the objection that real noise is analog.

Step 1. Apply the error to $\lvert\psi_L\rangle=\alpha\lvert000\rangle+\beta\lvert111\rangle$ : expanding $e^{-i\theta X_1}=\cos\theta\,I-i\sin\theta\,X_1$ gives $E\lvert\psi_L\rangle=\cos\theta\,\lvert\psi_L\rangle-i\sin\theta\,X_1\lvert\psi_L\rangle$ . Why: any single-qubit unitary is a combination of $I$ and a Pauli, so the post-error state is a superposition of the no-error and $X_1$ branches.

Step 2. Note $X_1\lvert\psi_L\rangle=\alpha\lvert100\rangle+\beta\lvert011\rangle$ lies in the syndrome- $(-1,+1)$ subspace, while $\lvert\psi_L\rangle$ lies in the syndrome- $(+1,+1)$ subspace. Why: the branches carry orthogonal syndromes, so the stabilizer measurement separates them cleanly with no residual coherence.

Step 3. Measure the generators: with probability $\cos^2\theta$ the outcome is $(+1,+1)$ and the state collapses to $\lvert\psi_L\rangle$ ; with probability $\sin^2\theta$ it is $(-1,+1)$ and collapses to $X_1\lvert\psi_L\rangle$ . Why: the Born rule weights each branch by its squared amplitude, and measurement leaves a definite, correctable Pauli error.

Step 4. Apply the indicated recovery — nothing in the first case, $X_1$ in the second, since $X_1\big(X_1\lvert\psi_L\rangle\big)=\lvert\psi_L\rangle$ . Both branches end at exactly $\lvert\psi_L\rangle$ . Why: recovery is deterministic given the syndrome, so $\theta$ is fully digitized away — the recovery fidelity is 1 regardless of $\theta$ . *Verified: orthogonal syndromes give a clean projective split and both branches recover $\lvert\psi_L\rangle$ deterministically — the discretization theorem, Nielsen and Chuang section 10.1.*

Go deeper · Derivation C · 1 minVerifying the Knill-Laflamme conditions for the bit-flip error set

Derivation CVerifying the Knill-Laflamme conditions for the bit-flip error set

The goal is to certify, without reference to any decoder, that $\{I,X_1,X_2,X_3\}$ is correctable by checking the Knill–Laflamme conditions $\langle\bar i\rvert E_a^{\dagger}E_b\lvert\bar j\rangle=C_{ab}\,\delta_{ij}$ directly on $\lvert\bar0\rangle=\lvert000\rangle$ and $\lvert\bar1\rangle=\lvert111\rangle$ . Passing this test is the decoder-independent statement that recovery exists — the same criterion that generalizes to every stabilizer and topological code.

Step 1. Take distinct errors, $E_a^{\dagger}E_b=X_iX_j$ with $i\neq j$ . Acting on $\lvert000\rangle$ this gives a Hamming-weight-2 string, orthogonal to both $\lvert000\rangle$ and $\lvert111\rangle$ . Why: two flips can never turn 000 into 000 or 111, so the overlap with either codeword vanishes.

Step 2. Hence the off-diagonals vanish: $\langle\bar0\rvert X_iX_j\lvert\bar0\rangle=0$ , $\langle\bar1\rvert X_iX_j\lvert\bar1\rangle=0$ , and the cross term $\langle\bar0\rvert X_iX_j\lvert\bar1\rangle=0$ . Why: a vanishing off-diagonal $C_{ab}$ ( $a\neq b$ ) means the errors are perfectly distinguishable — the non-degenerate case.

Step 3. Take equal errors, $E_a^{\dagger}E_a=I$ , so $\langle\bar i\rvert I\lvert\bar j\rangle=\delta_{ij}$ , independent of $a$ . Why: the diagonal entries $C_{aa}=1$ carry no dependence on $i,j$ — the "no deformation" half: errors do not distort the logical information.

Step 4. Assemble: $C_{ab}=\delta_{ab}$ , a Hermitian, logical-index-independent matrix, so both conditions hold and the set is correctable. Why: $C=\mathrm{diag}(1,1,1,1)$ is non-degenerate — the four errors are correctable and pairwise distinguishable. *Verified: $C_{ab}=\delta_{ab}$ ; off-diagonals vanish by weight counting and diagonals equal 1, matching the Knill–Laflamme theorem (Phys. Rev. A 55, 900).*

Limiting cases

Case	Result	Meaning
Single bit flip	$X_i\,(\alpha\lvert000\rangle+\beta\lvert111\rangle)$	Perfectly corrected — a unique nonzero syndrome names $i$ , and reapplying $X_i$ restores the codeword exactly.
Two bit flips	$X_iX_j\,\lvert\psi_L\rangle$	Misread as the single flip on the third qubit, so majority decoding fails — logical error of order $3p^2$ .
Phase error	$Z_i\,\lvert\psi_L\rangle=\alpha\lvert000\rangle-\beta\lvert111\rangle$	Syndrome is trivial $(+1,+1)$ ; the error is invisible and acts as logical $\bar Z$ — no protection at all.
Continuous rotation	$e^{-i\theta X_i}=\cos\theta\,I-i\sin\theta\,X_i$	Syndrome measurement collapses to "no flip" or "full flip"; correction is exact in either branch.
High noise $p\to1/2$	$p_{\text{fail}}\to1/2$	Break-even — the encoded and unencoded curves meet; above it, encoding hurts.

Common trapThe encoded state is three copies of the qubit

It is not, and this is the single most common misreading. The codeword $\alpha\lvert000\rangle+\beta\lvert111\rangle$ is an entangled superposition, whereas $(\alpha\lvert0\rangle+\beta\lvert1\rangle)^{\otimes3}=\alpha^3\lvert000\rangle+\alpha^2\beta\lvert001\rangle+\dots$ is a different, unprotected state that no-cloning forbids you from building from an unknown qubit anyway. The redundancy lives in correlations, not copies. Two further traps ride along: never measure the physical qubits in the computational basis to "check" them, because that collapses $\alpha,\beta$ — measure only the parities, which are blind to the logical amplitudes. And expect no protection against phase noise: a single $Z_i$ is undetected and is precisely the logical operation $\bar Z$ , so this code is strictly one-sided.

Worked examples

1 · Tracing a bit flip through the full cycle (fully worked)

A qubit $\sqrt{0.8}\,\lvert0\rangle+\sqrt{0.2}\,\lvert1\rangle$ is encoded, then qubit 2 suffers an $X$ error. Follow the state through syndrome measurement and recovery, and confirm the amplitudes survive.

Step 1. Encode: the two CNOTs give $\lvert\psi_L\rangle=\sqrt{0.8}\,\lvert000\rangle+\sqrt{0.2}\,\lvert111\rangle$ , so $|\alpha|^2=0.8$ , $|\beta|^2=0.2$ , sitting in the $+1$ eigenspace of both generators.

Step 2. Apply $X_2$ : it flips the middle qubit of each term, giving $\sqrt{0.8}\,\lvert010\rangle+\sqrt{0.2}\,\lvert101\rangle$ . The amplitudes ride along untouched — the error moved the support, not the weights.

Step 3. Measure $Z_1Z_2$ : on $\lvert010\rangle$ , $(+1)(-1)=-1$ ; on $\lvert101\rangle$ , $(-1)(+1)=-1$ . Both branches agree, so $s_1=\mathbf{-1}$ with certainty and nothing is disturbed. Likewise $Z_2Z_3$ gives $-1$ on both, so $s_2=\mathbf{-1}$ .

Step 4. Decode $(s_1,s_2)=(-1,-1)$ : uniquely $X_2$ . The measurement returned only these two sign bits and revealed nothing about $0.8$ versus $0.2$ .

Step 5. Recover by applying $X_2$ : $\sqrt{0.8}\,\lvert010\rangle+\sqrt{0.2}\,\lvert101\rangle\to\sqrt{0.8}\,\lvert000\rangle+\sqrt{0.2}\,\lvert111\rangle=\lvert\psi_L\rangle$ . The state is restored exactly, with $|\alpha|^2=0.8$ and $|\beta|^2=0.2$ intact — a full detect-and-correct cycle with zero disturbance to the logical information.

2 · When does encoding actually pay off?

Compare the encoded and unencoded error at $p=0.1$ and at $p=0.01$ , and find the break-even rate.

Step 1. At $p=0.1$ : $p_{\text{fail}}=3(0.01)-2(0.001)=0.03-0.002=\mathbf{0.028}$ , a factor $0.1/0.028\approx\mathbf{3.6}$ better than the bare $0.1$ .

Step 2. At $p=0.01$ : $p_{\text{fail}}=3\times10^{-4}-2\times10^{-6}=2.98\times10^{-4}$ , a factor $\approx\mathbf{34}$ improvement — the gain grows as $1/p$ because $p_{\text{fail}}\approx3p^2$ .

Step 3. Break-even at $p_{\text{fail}}=p$ : $3p^2-2p^3=p\Rightarrow(2p-1)(p-1)=0$ , so $p=\tfrac12$ . Encoding helps for every $p<0.5$ and hurts above it; the lower the physical rate, the larger the quadratic payoff.

3 · Digitizing a coherent over-rotation

A calibration error rotates qubit 1 by $\theta=0.10$ rad about the $x$ axis, $e^{-i\theta X_1}$ . What are the branch probabilities, and the state after recovery?

Step 1. Expand: $e^{-i\theta X_1}\lvert\psi_L\rangle=\cos\theta\,\lvert\psi_L\rangle-i\sin\theta\,X_1\lvert\psi_L\rangle$ , the two branches carrying syndromes $(+1,+1)$ and $(-1,+1)$ .

Step 2. With $\theta=0.10$ : $\cos^2\theta=(0.995004)^2=\mathbf{0.99003}$ for the no-error branch, $\sin^2\theta=(0.099833)^2=\mathbf{0.00997}$ for the flip branch — about a $1\%$ chance the syndrome flags qubit 1.

Step 3. Whichever branch is realized, recovery restores $\lvert\psi_L\rangle$ exactly: nothing on $(+1,+1)$ , $X_1$ on $(-1,+1)$ . The continuous $0.10$ -rad error is digitized to a coin flip between "no correction" and "one $X_1$ ", with post-recovery fidelity exactly 1 — the analog error is fully absorbed by the discrete code.

Physics of the portrait

The bit-flip code is not usually named for a person, but its birth is inseparable from one 1995 paper. In the mid-1990s the prevailing wisdom held that quantum error correction was impossible — measurement collapses the state, no-cloning bars redundancy, errors are continuous. The person who showed all three objections surmountable was Peter Shor.

Origins · 1 minPeter Shor and how this was discovered

Peter Shor

b. 1959 · the first quantum error-correcting codes and fault tolerance

Peter Williston Shor, an American mathematician at MIT, had already detonated the field in 1994 with his polynomial-time quantum factoring algorithm — a result that made large-scale quantum computers suddenly worth building, and their fragility suddenly the central obstacle. The reigning view was that decoherence would wash out any quantum computation long before it finished, and that classical-style error correction was forbidden here: you cannot copy an unknown state (no-cloning), you cannot look at it without collapsing it (measurement), and the errors form a continuum. In 1995 Shor answered all three at once. His nine-qubit code stores one logical qubit in an entangled block whose inner layer is precisely the three-qubit bit-flip code studied here, wrapped by an outer phase-flip layer: redundancy without cloning comes from entanglement, collapse is avoided by measuring only commuting parity checks, and the continuum is defeated by the discretization those measurements enforce. Within a year Steane gave an independent seven-qubit code, Calderbank–Shor and Steane produced the CSS family, Knill and Laflamme wrote down the general conditions for a code to work, and Gottesman recast the subject in the stabilizer language this article speaks. Shor shared the Gödel and Nevanlinna Prizes, and the small code at the heart of his construction remains the first thing every student of quantum error correction learns to run.

History

1995

— Shor introduces the nine-qubit code, whose inner layer is the three-qubit bit-flip code

1996

— Steane presents an independent seven-qubit code and the CSS construction

1996

— Calderbank and Shor prove good quantum codes exist, founding the CSS family

1997

— Knill and Laflamme state the general conditions for quantum error correction

1997

— Gottesman recasts codes in the stabilizer formalism used here

1998

— Cory and collaborators demonstrate three-qubit error correction in NMR

Going further

Texts. Nielsen and Chuang, Quantum Computation and Quantum Information, section 10.1 (the definitive introduction) · Preskill, Lecture Notes on Quantum Computation, chapter 7 · Wilde, Quantum Information Theory, chapter 22 · Kitaev, Shen and Vyalyi, Classical and Quantum Computation, section 13 · Mermin, Quantum Computer Science, chapter 5 · Gottesman, Stabilizer Codes and Quantum Error Correction (PhD thesis, 1997).

Provenance. Every result here is textbook-standard and recomputable. A verifier should confirm: (1) the two-CNOT encoder yields $\alpha\lvert000\rangle+\beta\lvert111\rangle$ and both generators return $+1$ on both codewords; (2) the syndrome dictionary $I\!\to\!(+,+)$ , $X_1\!\to\!(-,+)$ , $X_2\!\to\!(-,-)$ , $X_3\!\to\!(+,-)$ gives four distinct outcomes; (3) $p_{\text{fail}}=3p^2-2p^3$ by binomial counting, with break-even at $p=1/2$ ; (4) the Knill–Laflamme matrix $C_{ab}=\delta_{ab}$ ; and (5) the discretization branch probabilities $\cos^2\theta,\sin^2\theta$ for $e^{-i\theta X_i}$ . The historical claims trace to Shor (Phys. Rev. A 52, R2493, 1995), Steane (1996), Knill and Laflamme (Phys. Rev. A 55, 900, 1997), Gottesman's thesis (1997), and the Google repetition-code and surface-code experiments (Nature, 2021–2024).

Builds on: Quantum Error Model and Decoherence Channels · Pauli Group and Clifford Group · Discretization of Errors. Leads to: Three-Qubit Phase-Flip Code · Shor Nine-Qubit Code · Stabilizer Formalism · Syndrome Measurement and Decoding · Knill–Laflamme Conditions.

Ask the tutor: Ask me to walk an $X_1$ or two-qubit error through the syndrome table, derive the phase-flip dual by Hadamard conjugation, or show how two of these blocks nest into Shor's nine-qubit code.

Why can't I just make three copies of the qubit and vote?

Two reasons that reinforce each other. First, the no-cloning theorem says no unitary can turn an unknown $\alpha\lvert0\rangle+\beta\lvert1\rangle$ into two independent copies, so "write it three times" is not available. Second, even if you could, $(\alpha\lvert0\rangle+\beta\lvert1\rangle)^{\otimes3}$ is a different, unprotected state — it spreads amplitude across all eight basis strings with no clean parity structure. The code instead builds the entangled codeword $\alpha\lvert000\rangle+\beta\lvert111\rangle$ with two CNOTs, storing the information in correlations, and replaces voting with parity checks that compare neighbours without reading them.

How can we detect an error without measuring — and collapsing — the qubit?

By measuring the right observables. The generators $Z_1Z_2$ and $Z_2Z_3$ commute with both logical operators $\bar X$ and $\bar Z$ , so measuring them cannot disturb the encoded amplitudes. On an uncorrupted codeword they return $+1$ deterministically — a certain outcome causes no collapse. After an error they distinguish only which orthogonal syndrome subspace the state occupies, never whether the logical value leans toward $\lvert0\rangle_L$ or $\lvert1\rangle_L$ . The parities ask "do the qubits agree?", never "what is the qubit?" — exactly the information a corrector needs and a snoop must not have.

What actually happens to a continuous, partial rotation error?

It gets digitized. The noise $e^{-i\theta X_1}=\cos\theta\,I-i\sin\theta\,X_1$ turns the encoded state into a superposition of the untouched codeword (weight $\cos^2\theta$ ) and the fully $X_1$ -flipped codeword (weight $\sin^2\theta$ ). These carry different syndromes, so measuring the stabilizers collapses the superposition onto one — either "no error" or "a complete $X_1$ ", each of which the code handles exactly. The angle $\theta$ only sets the probability of each outcome; it never leaves a half-corrected residue. This is the discretization theorem, and it is why correcting a finite set of Pauli errors suffices to correct the entire continuum.

Why is this called a distance-3 code if it only fixes bit flips?

Distance is the smallest weight of a logical operator, stated relative to an error model. Against $X$ -type errors alone, the lightest logical bit flip is $\bar X=X_1X_2X_3$ , weight 3, so the code has distance 3 and corrects any single $X$ (a distance-3 code corrects $\lfloor(3-1)/2\rfloor=1$ error). Against the full Pauli group the story changes: $\bar Z=Z_1$ has weight 1, so a single $Z$ is already a logical fault and the distance collapses to 1. Both are true at once — distance-3 for the noise it was built for, distance-1 for the noise it ignores. That asymmetry is exactly why it is only half of a complete code.

How does this code become Shor's nine-qubit code?

By concatenation with its mirror image. Conjugating every operator by Hadamards turns $Z$ into $X$ and vice versa, giving the three-qubit phase-flip code, which protects against $Z$ errors using codewords $\lvert\pm\rangle^{\otimes3}$ . Shor nests them: encode the logical qubit into three "block" qubits with the phase-flip code, then encode each block into three physical qubits with the bit-flip code, for nine qubits total. The outer layer catches phase errors between blocks while each inner block catches bit flips, and together they correct an arbitrary single-qubit error — the first code ever to do so. The bit-flip code thus appears, literally, three times inside the first complete quantum code.

Is 3p² − 2p³ the whole story of how well the code performs?

It is the story for the idealized model — independent bit flips at rate $p$ , perfect gates, flawless instantaneous measurement. Real devices break each assumption: encoding and syndrome-extraction circuits inject their own errors, measurements are noisy and slow, and errors can be correlated. A fault-tolerant analysis therefore replaces the clean $3p^2$ with a threshold statement — encoding helps only if the physical rate is below a code- and circuit-dependent threshold, which the repetition-code experiments test directly. The formula remains the right intuition and leading behaviour, but the threshold is what governs a running machine.