Toric and Surface Codes

In short

The toric code (Kitaev, 1997) and its planar sibling the surface code are stabilizer codes laid out on a two-dimensional lattice. Qubits live on the edges of the lattice. At every vertex you measure a 4-body parity A_v = Z Z Z Z on the four edges meeting there; at every plaquette (square face) you measure a 4-body parity B_p = X X X X on its four edges. Each A_v and each B_p is a stabilizer. They all commute pairwise because every vertex and every plaquette share either zero edges or exactly two — and two anticommutations cancel. The toric code on an L \times L torus has n = 2L^2 physical qubits, k = 2 logical qubits, and distance d = L: a [[2L^2, 2, L]] code. The planar surface code variant lives on a flat rectangle with boundaries; it gives k = 1 logical qubit on roughly d^2 + (d-1)^2 physical qubits at distance d. Errors appear on the lattice as pairs of point-like defects (syndrome violations) at the endpoints of error chains. A classical decoder — minimum-weight perfect matching — pairs the defects and proposes the lightest correction. The code's big selling points: every stabilizer is a local 4-qubit measurement (nearest-neighbour only), the threshold is roughly 1% per gate (orders of magnitude looser than concatenated codes), and the code distance grows as you simply make the lattice bigger. Google, IBM, AWS, and Quantinuum all target the surface code for fault-tolerant quantum computing. In December 2024, Google's Willow chip demonstrated that pushing from distance 3 to distance 5 to distance 7 actually decreased the logical error rate — the first clean experimental evidence of operating below the surface-code threshold on real hardware.

You have now met a small zoo of quantum error-correcting codes. The 3-qubit bit-flip code protects against one X error. Shor's 9-qubit code protects against any single-qubit error. Steane's 7-qubit code does the same on two qubits fewer, inheriting transversal Clifford gates from the classical Hamming code. The 5-qubit perfect code saturates the quantum Singleton bound at [[5, 1, 3]]. All of these are small codes: fixed n, fixed d = 3, good for pedagogy and for benchmarking.

None of them is what Google, IBM, AWS, or the Indian National Quantum Mission are building hardware for. The code that every serious fault-tolerance roadmap assumes is the surface code, and its mathematically cleaner cousin the toric code. Both were proposed by Alexei Kitaev in 1997 as a new kind of quantum code — one where stabilizers are local on a 2D lattice, where the code distance grows smoothly as the lattice grows, and where error correction uses a classical algorithm (minimum-weight perfect matching) that is efficient enough to run in real time on control electronics.

This chapter builds the toric code from first principles, then moves to the planar surface code (the version that fits on a real chip), works out what a syndrome looks like, shows how a decoder pairs defects, and closes with the 2024 Google Willow result that — for the first time — put a surface-code demonstration below threshold on physical hardware.

Qubits on the edges of a lattice

The first thing that makes Kitaev's codes different is where the qubits live. In the codes you have seen so far, qubits are a flat list: qubit 1, qubit 2, ..., qubit n. The stabilizer S_3 = X_1 X_4 X_7 X_9 can act on any subset; there is no geometry.

In the toric code there is geometry. Draw a square lattice — think graph paper. It has vertices where grid lines cross, edges connecting adjacent vertices, and plaquettes (the unit squares themselves).

Place one qubit on every edge. Not on vertices, not inside plaquettes — on the line segments.

For an L \times L torus (a square lattice with the top edge glued to the bottom and the left glued to the right), there are L^2 horizontal edges and L^2 vertical edges, so n = 2L^2 physical qubits. For a 5 \times 5 torus, 50 qubits. For a 25 \times 25 torus, 1250 qubits. The number of qubits grows with the area of the lattice.

The toric-code lattice. Vertices sit at grid crossings; qubits sit on edges; plaquettes are the unit squares. On an $L \times L$ torus (left-right and top-bottom identified), there are $L^2$ vertices, $L^2$ plaquettes, and $n = 2L^2$ qubits. The crucial feature: every stabilizer will act on only four qubits, and those four qubits will be geometric neighbours.

The torus part — gluing opposite edges — is a mathematical convenience that keeps the lattice homogeneous: every vertex looks the same, every plaquette looks the same, there are no boundary effects. Real hardware does not build a torus (you can't wrap a chip around); real hardware uses the flat surface-code variant with boundaries. We come back to that in §4. For now, the torus makes the symmetry clean and the counting easy.

The two kinds of stabilizer

Kitaev's code has two families of stabilizer generators — one per vertex, one per plaquette.

Vertex operators: A_v = Z Z Z Z

Pick any vertex v. Four edges meet at it — up, down, left, right. The four qubits on those four edges form a star around the vertex. The vertex stabilizer is the 4-body Z operator on exactly those four qubits:

A_v \;=\; Z_{e_1} \, Z_{e_2} \, Z_{e_3} \, Z_{e_4}

where e_1, e_2, e_3, e_4 are the four edges incident to v.

This is a parity check in the Z basis: A_v's +1 eigenstates are exactly the basis states where the four qubits around v have even total parity (even number of |1\rangles among them). A single X error on any one of those four qubits flips a |0\rangle to a |1\rangle (or vice versa), changing the parity from even to odd — and the A_v measurement would return -1 instead of +1. That -1 is a syndrome violation sitting at vertex v.

Plaquette operators: B_p = X X X X

Pick any plaquette p — a unit square. Its boundary has four edges (top, bottom, left, right of the square). The four qubits on those edges form a plaquette loop. The plaquette stabilizer is the 4-body X operator on exactly those four qubits:

B_p \;=\; X_{e_1} \, X_{e_2} \, X_{e_3} \, X_{e_4}

where now e_1, \ldots, e_4 are the four edges bordering p.

By the same logic, B_p's +1 eigenstates have even parity in the X basis around the plaquette. A single Z error on any edge of the plaquette flips this parity, and the B_p measurement returns -1 — a syndrome violation sitting at plaquette p.

The two stabilizer types. A vertex operator $A_v$ measures the $Z$-parity of the four qubits on the four edges meeting at vertex $v$ — a star of four edges. A plaquette operator $B_p$ measures the $X$-parity of the four qubits on the four edges bordering plaquette $p$ — a square loop of four edges. Every stabilizer has weight exactly 4; every stabilizer is local — its qubits are geometric neighbours on the lattice.

They all commute

For a valid stabilizer code, every A_v must commute with every other A_{v'}, every B_p with every other B_{p'}, and every A_v with every B_p. Check each:

A_v and A_{v'}. Both are products of Zs. Z commutes with Z on any qubit. So A_v A_{v'} = A_{v'} A_v trivially. Commute.

B_p and B_{p'}. Both are products of Xs. X commutes with X. Commute.

A_v and B_p. This is the one that could fail. A_v has Zs, B_p has Xs, and Z and X anticommute on any shared qubit. So A_v and B_p anticommute on each qubit where both act non-trivially — that is, on every edge that is both incident to vertex v and bordering plaquette p.

How many such edges are there? Here is where the lattice geometry saves everything. Take any vertex v and any plaquette p. Either v is not a corner of p — then no edges of p are incident to v (zero shared non-identity qubits, commute trivially) — or v is a corner of p, in which case exactly two edges of p meet at v (the two sides of the square touching that corner). Two anticommutations cancel: A_v B_p = (-1)^2 B_p A_v = +B_p A_v. Commute.

Why two anticommutations give commutation: when you swap two multi-qubit Pauli operators past each other, each position where they anticommute contributes a factor of -1. An even number of anticommutations gives (-1)^{\text{even}} = +1 and the operators overall commute. An odd number gives -1 and they anticommute. Every (A_v, B_p) pair in the toric code has either zero or two shared non-identity qubits, never one or three — the geometric symmetry of the lattice enforces it.

So the full stabilizer group is generated by the L^2 vertex operators and the L^2 plaquette operators, a total of 2L^2 generators on 2L^2 qubits. If all were independent, the code space would have dimension 2^{2L^2} / 2^{2L^2} = 1 — a single state, no logical qubits. But the generators are not all independent.

The two logical qubits of the torus

Here is the subtle fact that makes the toric code interesting. The vertex operators A_v are not all independent: their product over every vertex in the lattice is the identity. Why? Each edge has two vertex endpoints, so when you multiply all the A_v's together, every Z on every edge appears exactly twice — and Z^2 = I. The product of all vertex operators is I. That is one relation, reducing the rank of the vertex generators from L^2 to L^2 - 1.

Similarly, the product of all plaquette operators \prod_p B_p equals I (every edge borders two plaquettes on the torus). Another relation, reducing the plaquette rank to L^2 - 1.

So the stabilizer group has (L^2 - 1) + (L^2 - 1) = 2L^2 - 2 independent generators, not 2L^2. Plugging into the [[n, k, d]] counting:

k \;=\; n - (\text{independent generators}) \;=\; 2L^2 - (2L^2 - 2) \;=\; 2.

Two logical qubits. The torus, because of its topology, encodes two logical qubits into its 2L^2 physical ones.

What are the logical operators?

They are not local. The logical X and Z operators on each logical qubit are strings of Paulis that wrap around the torus — one going the long way horizontally, one going the long way vertically, on either the lattice or its dual lattice.

Explicitly, for the horizontally-wrapping logical of qubit 1:

Z_{L,1} = product of Z on every qubit along one horizontal row of edges (say, the top row of horizontal edges). This is a non-contractible loop on the lattice — it cannot be shrunk to a point because it wraps around the torus.
X_{L,1} = product of X on every qubit along one vertical column of edges on the dual lattice (which runs through plaquette centres, perpendicular to the horizontal loop).

Similar pair (X_{L,2}, Z_{L,2}) for the other logical qubit, using loops in the other cycle of the torus.

Each logical operator has weight L — it acts on L edges as it wraps around the lattice.

The logical operators of the toric code are strings that wrap around the torus. $Z_L$ (horizontal red dashed line) is the product of $Z$ on a full row of horizontal edges — it cannot be shrunk away because the torus has a hole in that direction. $X_L$ (vertical pink line through plaquettes) is the product of $X$ on a full column of vertical edges — it wraps the other way. Each has weight $L$, and that weight is the code distance $d = L$. A second logical qubit lives on the other pair of wrapping directions.

Why wrapping loops must be logical operators: a loop of Zs closes — at every vertex it passes through, it enters on one edge and exits on another, touching two edges incident to that vertex. Two anticommutations with A_v cancel, so the loop commutes with every vertex operator. And a horizontal loop doesn't share any plaquette's boundary entirely, but when you check carefully a wrapping horizontal Z-loop crosses every vertical column exactly once and every horizontal row wholly, touching each B_p in exactly two edges — two anticommutations cancel again. So it commutes with all stabilizers. But it is not itself a product of stabilizers, because any product of A_v's is a contractible loop (it bounds a region of vertices), and the wrapping loop cannot be deformed to a contractible one. So: commutes with everything, is not in the stabilizer group — it is a logical operator.

The code distance is d = L. The smallest non-trivial logical operator is a wrapping loop, and the shortest wrapping loop on an L \times L torus has length L. So the toric code is [[2L^2, 2, L]]. For L = 5: 50 qubits, 2 logical qubits, distance 5. For L = 10: 200 qubits, 2 logical qubits, distance 10. You get more protection by enlarging the lattice — that is the whole selling point.

The planar surface code

The torus is beautiful theoretically but unbuildable physically. Real chips are flat. You can't glue opposite edges of a Google superconducting chip to make a torus; you have boundaries to worry about.

The surface code is the planar variant. Take a square region of the lattice and cut off the wrap-around gluing. The boundary edges need special treatment: some boundary plaquettes have only three edges instead of four, some boundary vertices only three incident edges. Two types of boundary are used, alternating:

Rough boundaries (top and bottom): the vertex operators on the boundary are truncated to weight 3 or are simply absent, depending on the convention. Z-logical strings terminate on these boundaries.
Smooth boundaries (left and right): the plaquette operators on the boundary are truncated similarly. X-logical strings terminate on these boundaries.

The net effect: instead of two logical qubits (one per wrapping direction of the torus), the planar surface code has one logical qubit, and its logical operators are strings that run from one boundary to the opposite boundary (rough-to-rough or smooth-to-smooth). The distance is still the length of the shortest such string, d = L where L is the lattice side length.

Qubit counts depend on the specific convention, but roughly: an L \times L surface code has n \approx 2L^2 physical qubits, k = 1 logical qubit, distance L. A common counting gives n = d^2 + (d-1)^2 for a rotated surface code at distance d: at d = 3, n = 9 + 4 = 13; at d = 5, n = 25 + 16 = 41; at d = 7, n = 49 + 36 = 85.

The torus (left) is the theoretician's lattice — homogeneous, with two logical qubits per code. The planar surface code (right) has explicit boundaries, alternating between rough (top/bottom) and smooth (left/right). The logical $Z$ is a string of $Z$s running from one rough boundary to the other; the logical $X$ is a string of $X$s running from one smooth boundary to the other. One logical qubit, the same distance $d = L$, and a layout that fits on a flat chip.

From here on, when the literature says "the surface code", they almost always mean the planar variant. The torus is the mathematical ideal that justifies the construction; the surface code is what gets built.

Error correction: defects at endpoints

Now the payoff. What happens when errors hit the code, and how does the decoder correct them?

A single X error

Suppose a single X error strikes one qubit in the middle of the lattice. That qubit sits on one specific edge. The edge has two vertex endpoints. An X error anticommutes with Z, so it flips the +1 eigenvalue of any vertex operator A_v whose star includes this qubit. The edge is incident to exactly two vertices — so the error flips the syndrome at two vertex operators: the two endpoints of the edge.

You see two A_v = -1 readings, sitting at the two endpoints of the affected edge. The plaquette operators are unaffected: X commutes with X, so B_p's don't flip.

A chain of X errors

Suppose an X error hits edge 1, and then another X error hits edge 2, and edges 1 and 2 share a vertex. What happens at the shared vertex? Both errors anticommute with the vertex operator there — two anticommutations cancel — so the shared vertex sees no syndrome violation. The two non-shared endpoints each see one anticommutation, so those endpoints do flip.

Extrapolate: for a chain of X errors along a connected path of edges, only the two endpoints of the chain show syndrome violations. All the vertices in the middle of the chain see two anticommutations that cancel out.

An $X$-error chain on four consecutive horizontal edges. The two endpoints of the chain (red vertices) show $A_v = -1$; every intermediate vertex along the chain sees its syndrome unchanged. This is the key topological feature of the code: errors appear as point-like defects at the endpoints of error chains, not as a distributed alarm. The decoder's job is to identify the defects and guess where the chain was.

The same thing happens with Z-error chains on the dual lattice, producing plaquette defects at the endpoints. So:

X-error chains on the primary lattice → pairs of vertex defects at their endpoints.
Z-error chains on the dual lattice → pairs of plaquette defects at their endpoints.

Decoding: minimum-weight perfect matching

After a round of syndrome measurement, the control electronics hold a list of defects — which vertices have A_v = -1, which plaquettes have B_p = -1. Vertex defects and plaquette defects are independent (vertex defects know about X errors; plaquette defects know about Z errors), so they decode separately.

For each defect list, the decoder asks: what is the most likely error chain that produced exactly this set of defects? Because defects come in pairs (the endpoints of chains), the decoder must pair them up and propose a chain connecting each pair. Under the natural probability model — each qubit has independent error probability p \ll 1 — the most likely configuration is the one that minimises the total number of errors, i.e. the total length of chains connecting the paired defects.

This is the classical graph problem called minimum-weight perfect matching (MWPM). Given a set of defects (graph nodes) and pairwise distances (shortest paths through the lattice), find the matching that minimises the total edge weight. Edmonds' algorithm (1965) solves MWPM in polynomial time, and modern fast variants (Blossom, sparse-graph tricks) run fast enough for real-time quantum-computing control electronics.

Once the decoder has the matching, it proposes a correction: apply X along each chain in the matching. If the proposed chain matches the actual error chain (up to the stabilizer equivalence — any closed loop of Xs is trivial), the correction succeeds. If the decoder guessed wrong — and it can, especially if the actual chain is longer than half the lattice — the correction combines with the original error to form a non-trivial logical operator, and you get a logical error.

The probability of logical error, as a function of the physical error rate p and the code distance d, scales as

P_{\text{logical}} \;\sim\; (p / p_{\text{th}})^{d/2},

where p_{\text{th}} \approx 0.01 is the surface-code threshold. As long as p < p_{\text{th}}, increasing d suppresses the logical error rate exponentially. Above the threshold, increasing d makes things worse.

Why the surface code wins

The surface code is, as of 2026, the favoured path to fault-tolerant quantum computing at Google, IBM, AWS, Quantinuum, IQM, and most academic-industry collaborations. Five reasons:

1. Local stabilizers. Every stabilizer is a 4-body operator on geometrically neighbouring qubits. On a superconducting chip this means every syndrome measurement involves only four qubits in a fixed plus-sign pattern — matching the physical connectivity of a 2D array of qubits with nearest-neighbour couplers. Codes like the 5-qubit perfect code or Steane's 7-qubit code have non-local stabilizers: to measure them, you need qubits that are far apart to interact, which superconducting hardware can't easily do.

2. High threshold. The surface code's threshold of roughly 1% per gate is 10 to 100 times looser than concatenated codes like concatenated-Steane (\sim 10^{-4}). This matters because "1% error per gate" is something current hardware can hit; "0.01% per gate" is not. The surface code is the only code whose threshold is reachable on 2026-era hardware.

3. Scalability by inflation. To increase the code distance, you simply make the lattice bigger. No redesign, no new code construction, no algorithm-specific tuning — just more qubits in the same pattern. This is architecturally huge: the same control electronics, the same decoder algorithm, the same calibration procedure all extend directly from d = 3 to d = 27.

4. Fast, classical decoder. Minimum-weight perfect matching is well-understood classical graph theory. Open-source decoders (PyMatching, Stim, union-find-decoder) run in milliseconds per syndrome round, fast enough for real-time control on FPGA hardware.

5. Clean fault-tolerance story. The threshold theorem (next chapter) applies directly. All the tricks for fault-tolerant gates — lattice surgery, code deformation, magic-state distillation — have been worked out specifically for the surface code. Every paper on "resource estimates for Shor's algorithm" in the last five years (and see resource estimates for RSA 2048) assumes surface-code encoding.

The catch. Surface-code overhead is substantial. A useful logical qubit at d \approx 25 needs roughly 1000–1500 physical qubits. A fault-tolerant T gate (non-Clifford) requires a magic-state distillation factory that costs an additional 10\times–100\times overhead. End-to-end, a cryptographically useful Shor's algorithm run on an RSA-2048 key requires roughly 20 million physical qubits in a surface-code architecture. That is a huge number. Hardware has to get there, and the surface code is the framework in which getting there makes sense.

Worked examples

Example 1: a distance-3 rotated surface code — count its qubits, stabilizers, logical qubit, distance

Consider the rotated surface code at distance d = 3, a common choice for small-scale experimental demonstrations. The lattice is a 3 \times 3 array of qubits, and the stabilizers are drawn on checkerboard-coloured plaquettes. Determine n, k, and d explicitly.

Step 1. Count the physical qubits. The rotated surface code at distance 3 has qubits on a 3 \times 3 grid — 9 data qubits. (The ancilla qubits used for syndrome measurement are additional; we count only data qubits for the code parameters.) Why the rotated layout: the original Kitaev convention places qubits on edges of a square lattice, giving 2d^2 qubits at distance d. The rotated surface code compresses this by rotating the lattice 45° and placing qubits at vertices, giving d^2 + (d-1)^2 qubits. For d = 3: 9 + 4 = 13 qubits including ancillae; 9 data qubits alone.

Step 2. Count the stabilizers. On the rotated lattice, stabilizers sit on the unit squares of the checkerboard. At distance 3 there are 4 Z-type (vertex-analogue) stabilizers and 4 X-type (plaquette-analogue) stabilizers, plus 2 weight-2 boundary stabilizers on each side — total 8 stabilizers.

Step 3. Apply the counting formula. n - k = 8, so k = 9 - 8 = 1. One logical qubit. Why the counting works: the surface code has n - 1 independent stabilizers on a patch of n data qubits when you account for the two redundancy relations present in the torus — but for the planar boundary, those redundancies are broken by the boundary, giving n - 1 full-rank stabilizers and k = 1. At distance 3 with 9 data qubits, 8 stabilizers, this gives k = 1.

Step 4. Find the code distance. The shortest logical Z operator is a string of Zs running from one rough boundary to the opposite one — three qubits long on the 3 \times 3 lattice. The shortest logical X is similarly a 3-qubit string between smooth boundaries. So d = 3.

Step 5. Assemble the parameters. The code is [[9, 1, 3]] — same three numbers as Shor's 9-qubit code, but with a completely different structure: local 4-body stabilizers on a flat 2D lattice instead of non-local 6-body operators.

Result. The rotated surface code at d = 3 is a [[9, 1, 3]] code. It encodes 1 logical qubit into 9 data qubits, with nearest-neighbour stabilizers, and corrects any single-qubit Pauli error.

The distance-3 rotated surface code. Nine data qubits sit on a $3 \times 3$ grid; eight stabilizer generators (alternating $Z$-type and $X$-type on a checkerboard of plaquettes) cut the space down to a 2-dimensional logical subspace. The logical $Z$ (red dashed string) runs from the top rough boundary through the middle column to the bottom rough boundary — weight 3, equal to the distance. The logical $X$ (not drawn) would run horizontally between smooth boundaries.

Example 2: a single $X$ error on a larger patch — trace the syndrome and the decoder's guess

Take a 5 \times 5 surface code patch. A single X error strikes one horizontal edge qubit somewhere in the middle of the patch. Describe the resulting syndrome and show what correction the minimum-weight matching decoder proposes.

Step 1. Identify the affected edge and its endpoints. The error hits an edge that is incident to two vertices. Call them v_a (left endpoint) and v_b (right endpoint). These are the two vertices whose vertex operator A_v includes this qubit's Z component.

Step 2. Compute the syndrome. Because X anticommutes with Z on the affected qubit, A_{v_a} and A_{v_b} both flip sign. Every other A_v on the lattice remains +1. Every B_p remains +1 (since X commutes with X). Why only two vertices flip: the error has weight 1 and acts on a single edge; that edge is incident to exactly two vertices; those are the only two vertex operators affected. No plaquette sees the X because plaquette stabilizers are products of Xs, and X commutes with X.

Step 3. Run the decoder's matching algorithm. The decoder sees two defects, at v_a and v_b. There is only one way to pair them (matching of 2 vertices has only one pairing). The shortest path through the lattice between v_a and v_b is one edge long — the affected edge itself. So the matching algorithm proposes a correction chain of length 1: apply X to the same edge that the error hit.

Step 4. Apply the correction. The correction is X on the affected edge. The combined operation (error + correction) is X \cdot X = I on that edge. The code state is restored exactly. Why the correction is exact, not just approximate: the decoder's proposed chain and the actual error chain have the same endpoints and, because both have minimum possible length, can be chosen to be identical. When they are identical, correction \times error = X \cdot X = I. The code state returns to its original value with zero logical error.

Step 5. What if the decoder pairs wrong? In this simple case there is only one pairing, so no ambiguity. For two X errors on the lattice you get 4 defects, and the matching algorithm picks the pairing with shortest total chain length. If the actual error chain configuration has the same total length as some other pairing, the decoder might choose the wrong one — but the correction still results in a closed loop of Xs on the lattice, which is a stabilizer (contractible loop) and acts as identity on the code. Only when the combined error + correction forms a non-contractible wrapping loop does the code actually fail logically. That requires a chain of length \geq d, and such events have probability scaling as (p/p_{\text{th}})^{d/2}.

Result. For a single X error, the decoder sees two defects at the endpoints of the affected edge, proposes a 1-edge correction, and restores the code perfectly. This is the simplest case of surface-code decoding; more errors give more defects and more ambiguity, but the same matching principle scales up.

The MWPM decoder at work on a single $X$ error. The error (red-circled $X$) sits on a horizontal edge between two vertex defects (red dots). The decoder, seeing only the two defects, solves minimum-weight perfect matching: one pair, shortest path between them is the single connecting edge. It proposes exactly the same edge as its correction. Error followed by correction is $X \cdot X = I$, and the code returns to its original logical state. Every subsequent round of syndrome measurement shows no defects.

Common confusions

"The surface code and the toric code are the same thing." Closely related, not identical. The toric code lives on a torus (top-bottom and left-right boundaries are identified) and encodes k = 2 logical qubits into n = 2L^2 physical qubits. The surface code lives on a flat rectangle with explicit boundaries and encodes k = 1 logical qubit. Both have distance d = L; both use the same A_v = Z Z Z Z, B_p = X X X X stabilizers in the bulk. The torus is the theoretician's version; the surface code is what gets built on hardware.
"Every stabilizer is a 4-qubit measurement, so the code is 'cheap'." Measuring a stabilizer is operationally cheap — four gates plus an ancilla, on nearest-neighbour qubits — but the overhead of the code as a whole is substantial. A useful logical qubit at d = 25 needs roughly 1000–1500 data qubits plus ancillae. The per-stabilizer cost is low; the per-logical-qubit cost is not.
"The distance d is the number of errors the code can correct." No — distance d is the minimum weight of a non-trivial logical operator. The code corrects up to \lfloor (d-1)/2 \rfloor errors. A distance-7 surface code corrects up to 3 errors per round per logical qubit.
"Surface codes work for every quantum gate." No — the surface code has transversal Clifford gates (CNOT, H, S as fault-tolerant operations on encoded qubits via lattice surgery or code deformation), but no transversal T gate. To do non-Clifford gates (the T gate, needed for universal quantum computation) the surface code relies on magic-state distillation, which is expensive — a magic-state factory for a single high-fidelity T-gate resource state can cost 10\times–100\times as many qubits as the logical qubit it serves.
"Topological protection means errors are impossible." No — topological protection means errors are local and create local syndromes, which the decoder can fix. Errors still happen; the code catches them before they become logical errors. As long as the physical error rate is below threshold, logical error rates can be made arbitrarily small by growing d.
"The surface code is the only viable fault-tolerant code." As of 2026 it is the leading candidate, but alternatives are active research. Color codes (three-colourable 2D lattice codes) have a richer set of transversal gates. Quantum LDPC codes have better asymptotic rate. Bosonic codes (cat codes, GKP codes) give hardware-level protection before discrete encoding. The surface code's dominance reflects the maturity of its tooling — decoders, layouts, magic-state protocols — more than a fundamental uniqueness.

Going deeper

You now have the toric code, the planar surface code, the 4-body stabilizers, the defect-pair structure of errors, and a first decoder. This section sketches Kitaev's 1997 anyonic interpretation, the formal proof of the \sim 1\% threshold, the matching-decoder algorithm, lattice surgery as a way to do gates on encoded qubits, the color-code alternative, and the 2024 Google Willow experimental milestone.

The anyonic picture: e and m particles

Kitaev's original 1997 paper didn't advertise the toric code as a quantum error correcting code — it advertised it as a model of topological order with abelian anyons. In the language of that paper, the syndrome defects are particles. A vertex defect is called an e particle (electric charge); a plaquette defect is called an m particle (magnetic flux). They are pointlike excitations above the ground state, and they have non-trivial statistics: when an e particle is braided around an m particle (taken on a closed loop that encircles it), the resulting global phase is -1. This is the signature of mutual semionic statistics — neither bosonic nor fermionic — and it is why the defects are called anyons.

The anyonic interpretation is not just colour: it is the reason topological quantum computation is a going concern. If you can create, manipulate, and braid non-abelian anyons (which the toric code's abelian anyons do not support — you need richer models like the Fibonacci or Ising anyon), the braiding itself would implement quantum gates, and the topological nature of the braid would make them intrinsically fault-tolerant. Microsoft's StationQ program pursues exactly this path via Majorana fermions. The toric code is the first and simplest model in which this intuition can be made mathematically precise.

Proving the \sim 1\% threshold

The threshold for the surface code is roughly p_{\text{th}} \approx 0.01 per gate under a standard depolarising noise model, as established by Dennis, Kitaev, Landahl, and Preskill in their 2002 paper "Topological quantum memory". The proof proceeds by mapping the code's error-correction problem onto a 2D statistical-mechanics model: the random-bond Ising model on a square lattice, where the error rate p plays the role of a disorder parameter and the logical-error probability plays the role of an order parameter. The threshold is the phase transition between a disorder-free (correctable) phase and a disorder-dominated (uncorrectable) phase. This transition happens at roughly p \approx 0.11 for ideal (uncorrelated bit-flip) noise and lower for realistic depolarising-plus-measurement noise — the combined budget ends up near 1% per gate.

Modern estimates (Fowler, Martinis, and others, 2012; Google Quantum AI, 2024) put the effective per-gate threshold between 0.5% and 1.5% depending on the specific noise model and which gates are slowest. The circuit-level threshold — where gate errors, measurement errors, and idle errors are all included — is typically quoted as p_{\text{th}} \approx 0.7\%–1\%.

Minimum-weight perfect matching, mathematically

MWPM is a classical combinatorial optimisation problem: given a graph with edge weights, find a perfect matching (every vertex paired with exactly one other) minimising the total weight. Edmonds's Blossom algorithm (1965) solves it in O(n^3) time, later improved to near-linear for sparse graphs.

For surface-code decoding, the graph is built by placing one node per defect, plus "virtual" boundary nodes to handle chains that run off the edge of the lattice. Edge weights are the shortest lattice-path lengths between defects. For a patch with V vertices and D defects, the decoder runs in O(D^3) time, and D is typically O(p \cdot V) — small enough for real-time control electronics to handle. Open-source implementations (PyMatching by Oscar Higgott, Stim by Craig Gidney) are the standard tools; both are Python-accessible and run at speeds competitive with custom hardware.

More recent decoders — union-find (Delfosse and Nickerson, 2017), neural-network decoders (Google DeepMind AlphaQubit, 2024) — trade off decoding accuracy for speed, and all of them outperform MWPM in certain regimes. The decoder landscape is an active research area.

Lattice surgery: gates on encoded qubits

Once you have a surface-code logical qubit, how do you do anything with it? Clifford gates on a single logical qubit (X, Z, H, S) are implemented by modifying the lattice itself — rotating, merging, and splitting patches. Two-qubit gates between logical qubits use lattice surgery: you "merge" two surface-code patches into a single larger patch along a shared boundary, perform a joint measurement, and "split" them back. The joint measurement amounts to a logical Z_L \otimes Z_L or X_L \otimes X_L, which — together with single-qubit Cliffords — generates CNOT and the full Clifford group on encoded qubits.

Lattice surgery is the current favoured method for multi-qubit operations on surface-code logical qubits. It gets its own chapter (ch.128) in this curriculum. The punchline: Clifford logical gates take roughly d physical rounds of syndrome measurement — fast in principle, but meaningful in any realistic timeline.

T gates are a different story. They cannot be implemented fault-tolerantly by code deformation alone on the surface code (the Eastin-Knill theorem, 2009, forbids a code from having a universal transversal gate set). Instead, the surface code uses magic-state distillation — a protocol that produces high-fidelity |T\rangle \propto |0\rangle + e^{i\pi/4} |1\rangle states in a separate "factory" of surface-code patches, then injects them into the main computation. Magic-state factories are expensive: a single T gate at error rate 10^{-15} can cost tens of thousands of physical qubits in the factory alone. See ch.127 on fault-tolerant gates and magic states for the full picture.

Color codes: the transversal-gate alternative

The color code (Bombín and Martín-Delgado, 2006) is another family of topological stabilizer codes, built on a three-colourable 2D lattice. The trade-off versus surface code: color codes have higher threshold-adjusted overhead (worse threshold in standard noise models) but richer transversal gate set — the full Clifford group is transversal on a 2D color code, whereas the surface code needs lattice surgery for two-qubit Cliffords. For some fault-tolerance proposals (especially those trying to minimise magic-state distillation), the color code is a competitive alternative. Neutral-atom platforms (QuEra, Atom Computing) have explored color-code encodings alongside surface-code encodings.

Google Willow, December 2024

Google's surface-code demonstrations have been building for five years. The most consequential data point is the December 2024 Willow result, published in Nature. Willow is a 105-qubit superconducting chip laid out as a surface-code patch. Google ran surface-code encodings at three distances — d = 3 (17 data qubits plus ancillae), d = 5 (49 data qubits plus ancillae), and d = 7 (97 data qubits plus ancillae) — and measured the logical error rate per syndrome round.

Key finding: going from d = 3 to d = 5 reduced the logical error rate by a factor of roughly 2.14. Going from d = 5 to d = 7 reduced it by a further factor of roughly 2.0. Error suppression with distance — the hallmark of operating below threshold — was clearly demonstrated on physical hardware for the first time. The per-cycle logical error rate at d = 7 reached \sim 10^{-3}, which is not yet useful for long algorithms, but the scaling is correct: more distance equals less error, exponentially.

Willow is not a useful fault-tolerant quantum computer. It is proof that a useful one is a straightforward engineering extension of what has now been demonstrated: scale the lattice further, add magic-state factories, bring the error rate down. The 2024 result is the first clean experimental evidence that the surface-code path to fault-tolerant quantum computing works in practice, not just on paper.

Indian surface-code research and the National Quantum Mission

India's National Quantum Mission (2023, ₹6000 crore over 8 years) includes fault-tolerant quantum computing as one of its four thematic pillars. Surface-code decoding, error-model characterisation, and near-term low-distance experiments have active groups at IIT Madras, IIT Bombay, IISc Bangalore, and TIFR Mumbai. TIFR's Tata Research experimental team has collaborated with IBM Quantum Network access to run small-scale repetition-code demonstrations; IIT Madras's quantum-information group has contributed to the decoder literature, including a 2024 preprint on neural-network-augmented MWPM. The broader Indian software industry (TCS, Infosys, Wipro) has quantum practices with surface-code knowledge as part of their post-quantum cryptography consulting. Expect the first Indian hardware surface-code demonstrations on NQM-funded chips in the 2027–2029 horizon.

Where this leads next

CSS codes — the parent class of codes built from two classical codes; the surface code is a CSS code with classical codes derived from lattice homology.
Stabilizer codes — the algebraic framework that toric and surface codes fit into.
Steane 7-qubit code — the small CSS code with transversal Clifford gates; useful pedagogical comparison to the surface code's non-transversal-but-local structure.
Threshold theorem — the statement that below-threshold codes (like the surface code at p < 1\%) can achieve arbitrarily small logical error.
Lattice surgery — the favoured method for doing gates on surface-code logical qubits.
Topological quantum computation — the anyonic interpretation of Kitaev's code, and the push toward non-abelian anyons for intrinsic fault tolerance.
Resource estimates for RSA 2048 — end-to-end numbers for Shor's algorithm on surface-code encoded hardware, including magic-state factories.

References

Alexei Kitaev, Fault-tolerant quantum computation by anyons (1997, published 2003) — arXiv:quant-ph/9707021. The original paper introducing the toric code and its anyonic interpretation.
Austin G. Fowler, Matteo Mariantoni, John M. Martinis, Andrew N. Cleland, Surface codes: Towards practical large-scale quantum computation (2012) — arXiv:1208.0928. The canonical practical reference for surface-code fault tolerance.
Google Quantum AI, Quantum error correction below the surface code threshold (Nature, December 2024) — arXiv:2408.13687. The Willow chip paper demonstrating below-threshold operation.
John Preskill, Lecture Notes on Quantum Computation, Chapter 7 (Quantum Error Correction) — theory.caltech.edu/~preskill/ph229. Pedagogical derivation including the toric code and its phase-diagram interpretation.
Wikipedia, Toric code — accessible overview with the lattice construction and anyonic interpretation.
Wikipedia, Surface code — planar-variant-focussed overview with decoder discussion and hardware-implementation pointers.