1 Introduction↩︎

Fault-tolerant quantum computing is expensive largely because a generic qubit suffers two kinds of error, bit flips (\(X\)) and phase flips (\(Z\)), and a general-purpose code such as the surface code must spend qubits suppressing both. Dissipative cat qubits change this accounting. A cat qubit encodes information in the phase space of a driven-dissipative bosonic mode, and as the mean photon number grows one of its two error channels is suppressed exponentially while the other grows only polynomially [1]–[3]. The result is a qubit with a tunable, and in practice enormous, noise bias: error rates asymmetric by factors of \(10^{5}\) or more have been demonstrated [3], [4]. Exploiting such an asymmetry to lower the cost of fault tolerance is a well-established idea [5]. In this regime one error type is so rare that it can be neglected, and the code above the cat qubit needs to correct only the dominant one.¹

This is a strong simplification, because a code that must correct only one Pauli error type is essentially a classical code. Any binary linear code with parity-check matrix \(H\) becomes a quantum code for the dominant error by promoting each row of \(H\) to a multi-qubit \(Z\)-type stabilizer, so that the classical syndrome and the quantum syndrome coincide. The encoded states are the classical codewords, the logical operators are inherited from the classical code, and, crucially, every gate involved (state preparation, the CNOT-based encoder, stabilizer measurement, and readout) is Clifford. Such circuits can be simulated exactly and at scale with the stabilizer simulator Stim [6].

This opens the door to high-rate classical codes that would be awkward or impossible to use as fully quantum (\(X\)-and-\(Z\)) codes. Reed–Solomon (RS) codes [7] are the canonical example: they are maximum distance separable (MDS), meaning they achieve the largest possible minimum distance for their rate, and they are ubiquitous in classical storage and communication. A quantum version of the RS code already exists: the Grassl–Beth construction [8] encodes and decodes through a discrete cyclic Fourier transform over the finite field, a non-Clifford operation. It is therefore not simulable in Stim, and, more fundamentally, it spends its power correcting both \(X\) and \(Z\) errors, which is exactly the redundancy that cat qubits render unnecessary.

In this work we take the opposite, deliberately minimal route. Our contributions are:

1. A Clifford-only quantum RS code. We construct the RS code \([7,3,5]\) over \(\mathrm{GF}(2^3)\), binary-expand it to \([21,9,6]\) over \(\mathrm{GF}(2)\), put it in systematic form, and realize it as the bit-flip stabilizer code \([[21,9,d_X=6,d_Z=1]]\) with an explicit CNOT encoder and \(Z\)-type checks (Sec. 3). No quantum Fourier transform appears, and the whole circuit is Clifford.

2. An optimal lookup decoder. Because the code is small, we decode with a lookup table of minimum-weight corrections built from the systematic parity-check matrix \(H=[P^{\mathsf T}\mid \mathrm{I}]\) (Sec. 3.5).

3. The Tornado concatenation. Inspired by classical Tornado codes [9], we wrap every position of the outer RS code in an inner distance-three repetition code, producing a \([[63,9,18]]\) concatenated code decoded in two stages, an inner majority vote followed by the outer RS lookup (Sec. 4).

4. Benchmarks and scaling. We compare the repetition, RS, and Tornado codes over two orders of magnitude in physical error rate, show that the Tornado logical error rate scales as \(p^{6}\) at low error rates, and quantify the qubit overhead and the assumptions of the noise model (Secs. 5–7).

2 Biased noise and bit-flip codes↩︎

2.0.0.1 Noise bias.

We work in the strong-bias limit: the suppressed error channel of the cat qubit is neglected entirely, and the only error is a bit flip \(X\) that strikes each physical qubit independently with probability \(p\). The same idealization underlies analyses of repetition cat codes [2], [10]; it is accurate whenever the bias \(\eta = p_{\text{dominant}}/p_{\text{suppressed}}\) is large, and in that regime a code that corrects a single type of error is all that is needed.

2.0.0.2 Classical linear codes as quantum bit-flip codes.

Let \(C\subseteq\mathbb{F}_2^{n}\) be a binary linear code with generator matrix \(G\) (\(k\times n\)) and parity-check matrix \(H\) (\((n-k)\times n\)), so that \(H G^{\mathsf T}=0\). We associate one physical qubit with each of the \(n\) bits and define, in the stabilizer formalism [11], the stabilizer group \[\mathcal{S} = \Big\langle\, S_r = \prod_{q:\,H_{rq}=1} Z_q \;:\; r=1,\dots,n-k \,\Big\rangle . \label{eq:stab}\tag{1}\] All generators are products of \(Z\) operators, hence mutually commuting and Clifford. The codespace is the \(+1\) eigenspace of \(\mathcal{S}\); its logical computational states \(\lvert c \rangle\) are labelled by the classical codewords \(c\in C\), and a bit-flip pattern \(e\in\mathbb{F}_2^{n}\) maps the state \(\lvert c \rangle\) to \(\lvert c\oplus e \rangle\). Measuring the stabilizers 1 returns precisely the classical syndrome \[\sigma = H e^{\mathsf T} \in \mathbb{F}_2^{\,n-k}, \label{eq:syndrome}\tag{2}\] so classical and quantum decoding are identical. This is a CSS code [12], [13] built from a single classical code: every stabilizer is of \(Z\) type, so the code corrects \(X\) errors and makes no attempt to correct \(Z\) errors. Its quantum parameters are \[[[\,n,\;k,\;d_X = d(C),\;d_Z = 1\,]], \label{eq:params}\tag{3}\] where \(d(C)\) is the classical minimum distance: a weight-\(1\) \(Z\) operator is already a logical operator (\(d_Z=1\)), which is harmless precisely because the cat qubit suppresses that error exponentially. These parameters generalize the cat repetition code \([[n,1,d_X=n,d_Z=1]]\) [2], which is recovered by taking \(C\) to be the length-\(n\) repetition code.

2.0.0.3 Circuit and error model.

Every logical error rate reported here is obtained under the following single-shot memory model, which matches our Stim implementation: (i) all data qubits are reset and the CNOT encoder prepares the logical all-zero codeword \(\lvert 0_{\mathrm L} \rangle\); (ii) each data qubit independently undergoes \(X\) with probability \(p\) (a single X_ERROR\((p)\) location); (iii) the \(Z\)-type stabilizers are measured once with a noiseless ancilla, yielding the syndrome 2 ; (iv) the data qubits are read out in the \(Z\) basis and the \(k\) message qubits are declared as logical observables. The decoder then applies the correction inferred from the syndrome and a logical failure is recorded whenever any logical observable is left flipped. This model isolates the code’s combinatorial error-correcting power; measurement and gate noise and repeated syndrome rounds are deliberately excluded and are discussed as limitations in Sec. 7.

3 Clifford quantum Reed–Solomon construction↩︎

3.1 The field \(\mathrm{GF}(8)\)↩︎

We work over the field \(\mathrm{GF}(2^3)=\mathbb{F}_2[x]/(x^3+x+1)\) with primitive polynomial \(x^3+x+1\) (0b1011). Field elements are \(3\)-bit strings interpreted as polynomials of degree \(<3\); addition is bitwise xor and multiplication is polynomial multiplication modulo \(x^3+x+1\). The element \(\alpha=2\) (i.e. \(x\)) is primitive: its powers enumerate all seven nonzero elements, \[(\alpha^{0},\dots,\alpha^{6}) = (1,2,4,3,6,7,5), \label{eq:evalpts}\tag{4}\] which we use as the evaluation points of the code.

3.2 Reed–Solomon over \(\mathrm{GF}(8)\)↩︎

The RS code encodes a message of \(k_{\mathrm s}=3\) field symbols \((m_0,m_1,m_2)\) as the evaluations of the polynomial \(m(y)=m_0+m_1 y+m_2 y^2\) at the \(n_{\mathrm s}=7\) points 4 : \[c_j = \sum_{i=0}^{2} m_i\,\alpha^{\,ij}, \qquad j=0,\dots,6 .\] Equivalently \(c = m\,G_{\mathrm{sym}}\) with the \(3\times7\) symbol generator \[G_{\mathrm{sym}} = \begin{pmatrix} 1 & 1 & 1 & 1 & 1 & 1 & 1\\ 1 & 2 & 4 & 3 & 6 & 7 & 5\\ 1 & 4 & 6 & 5 & 2 & 3 & 7 \end{pmatrix}, \label{eq:gsym}\tag{5}\] whose rows are the componentwise powers \((\alpha^{ij})_j\). This is a \([7,3,5]\) code over \(\mathrm{GF}(8)\). As an evaluation code it is maximum distance separable: its symbol distance meets the Singleton bound, \(d_{\mathrm s}=n_{\mathrm s}-k_{\mathrm s}+1=5\), so it corrects any \(t=\lfloor(d_{\mathrm s}-1)/2\rfloor=2\) symbol errors.

3.3 Binary expansion and systematic form↩︎

Quantum hardware acts on bits, not field symbols, so we expand \(G_{\mathrm{sym}}\) over \(\mathrm{GF}(2)\) by replacing each symbol operation with its action on the underlying \(3\)-bit strings. Encoding the \(9\) basis messages produces a \(9\times21\) binary generator matrix \(G_{\mathrm{bin}}\). Gaussian elimination over \(\mathrm{GF}(2)\), followed by a column permutation that collects the pivots, brings it to systematic form \[G_{\mathrm s} = [\,\mathrm{I}_{9}\mid P\,], \qquad P\in\mathbb{F}_2^{\,9\times12},\] from which the systematic parity-check matrix follows immediately, \[H = [\,P^{\mathsf T}\mid \mathrm{I}_{12}\,] \in \mathbb{F}_2^{\,12\times21}, \qquad H G_{\mathrm s}^{\mathsf T}=0 . \label{eq:H}\tag{6}\] A brute-force minimum-weight search over all \(2^{9}-1\) nonzero codewords gives a binary minimum distance of \(6\); the binary image of the RS code is therefore the linear code \([21,9,6]\), corrects \(t=2\) bit errors, and as a quantum bit-flip code has parameters \[[[\,21,\,9,\,d_X=6,\,d_Z=1\,]].\] The \(12\) rows of \(H\) are the supports of the \(12\) \(Z\)-type stabilizers; its structure is shown in Fig. 1. The systematic layout separates the \(21\) physical qubits into \(9\) message qubits and \(12\) parity qubits and directly dictates the encoder.

3.4 The encoder and stabilizer circuit↩︎

The systematic generator prepares the logical all-zero codeword from the physical all-zero state using only CNOTs: for every \(1\) in \(P\) we entangle the corresponding message and parity qubit, \[\text{if } P_{ij}=1:\quad \mathrm{CX}(\,\text{message } i \to \text{parity } 9+j\,).\] Syndrome extraction measures each stabilizer \(S_r\) of Eq. 1 by copying the parities of its support onto a fresh ancilla with CNOTs and measuring the ancilla in the \(Z\) basis, contributing one detector bit per row of \(H\). Finally the \(9\) message qubits are read out and declared as logical observables. Every operation is Clifford; the circuit compiles and samples directly in Stim [6]. This should be contrasted with the Grassl–Beth quantum RS code [8], whose encoder and decoder are built from the discrete cyclic Fourier transform over \(\mathrm{GF}(8)\): that transform is non-Clifford, cannot be sampled by a stabilizer simulator, and buys \(Z\)-error correction that a cat qubit does not need.

3.5 Maximum-likelihood lookup decoder↩︎

For a code this small, optimal decoding is a table lookup. We precompute, for every attainable syndrome, the minimum-weight error consistent with it: we enumerate error patterns in order of increasing weight \(w=0,1,2,3\) and record the first pattern that produces each syndrome, which is by construction a minimum-weight coset leader, \[\hat{e}(\sigma) = \arg\min_{e:\,He^{\mathsf T}=\sigma} \mathop{\mathrm{wt}}(e).\] The enumeration yields a table with \(1359\) distinct syndromes out of the \(2^{12}=4096\) possible. Every error of weight at most \(2\) is corrected exactly, as the distance guarantees, and the weight-\(3\) leaders fill in additional syndromes so that some weight-\(3\) errors are corrected as well. A logical failure is declared when the residual error \(e\oplus\hat{e}\) is a nonzero codeword, i.e.when the decoder returns to a wrong codeword or the syndrome lies outside the table. We verified that this classical decoder, applied directly to random error patterns, agrees with the same decoder applied to the detector samples of the full Stim circuit to within Monte Carlo error (e.g.\(p_{\mathrm{L}}=0.182\) vs.\(0.181\) at \(p=0.1\), consistent with Fig. 3), as it must for a purely classical \(X\)-error channel.

4 The Tornado concatenation↩︎

4.1 Motivation↩︎

The RS code is high-rate but fragile: with \(d_X=6\) it tolerates only two bit flips among \(21\) qubits, so at large \(p\) its logical error rate is actually worse than a simple repetition code (Fig. 3). A repetition code is the opposite: extremely robust but wasteful of qubits. Classical Tornado codes [9] resolve exactly this tension by layering sparse graph codes with an outer high-rate code so that each layer cleans up the errors that slip past the previous one. We adopt a deliberately simple, two-layer instance of this idea suited to biased-noise qubits.

4.2 Architecture↩︎

The Tornado code concatenates an inner distance-three repetition code inside the outer RS code, as sketched in Fig. 2. Each of the \(n=21\) positions of an RS codeword is itself encoded into a block of \(d_{\mathrm{in}}=3\) physical cat qubits by a repetition code. The composite code therefore uses \[N = n\cdot d_{\mathrm{in}} = 21\times3 = 63\] physical qubits to protect \(k=9\) logical qubits. Concatenation multiplies distances, so the \(X\)-distance of the composite code is \[d_X = d_{\mathrm{in}}\cdot d(C) = 3\times6 = 18,\] while \(d_Z\) remains \(1\); the Tornado code is \([[63,9,18]]\). Its rate is \(9/63=1/7\).

4.3 Two-stage decoder↩︎

Decoding mirrors the encoding, from the inside out. For each of the \(21\) repetition blocks the inner decoder takes a hard majority vote over its \(d_{\mathrm{in}}=3\) qubits, producing a single effective bit. A block is decoded incorrectly exactly when at least two of its three qubits flipped, which happens with the effective error probability \[q(p) = \binom{3}{2}p^{2}(1-p) + p^{3} = 3p^{2}-2p^{3} \approx 3p^{2}. \label{eq:qeff}\tag{7}\] The \(21\) effective bits are then handed to the outer decoder, which is exactly the RS syndrome lookup table of Sec. 3.5 applied with error rate \(q(p)\) in place of \(p\). Because the noise is a classical \(X\) channel and both layers are CSS, this two-stage hard-decision procedure is equivalent to a stabilizer simulation of the full \(63\)-qubit circuit, and we evaluate it directly by Monte Carlo sampling.

5 Numerical results↩︎

Figure 3 is the central result: the logical error rate \(p_{\mathrm{L}}\) of the repetition code \([[3,1,3]]\), the standalone RS code \([[21,9,6]]\), and the Tornado code \([[63,9,18]]\) as a function of the physical bit-flip rate \(p\), over \(p\in[10^{-3},10^{-1}]\). The repetition curve is the exact majority-vote expression \(3p^2-2p^3\); the RS and Tornado curves are Monte Carlo simulations of the decoders of Secs. 3.5 and 4, with up to \(8\times10^{6}\) shots per point and \(1\sigma\) Poisson error bars. Representative values are collected in Table 1.

Three features stand out. First, the RS and repetition curves cross near \(p\approx0.013\): below it the high-rate RS code wins, above it the robust repetition code wins, quantifying the trade-off between density and robustness. Second, the Tornado code is below both parents throughout the resolvable range; at \(p=0.1\) it reaches \(p_{\mathrm{L}}\approx5.3\times10^{-3}\), a factor of \(5.3\) below the repetition code and \(34\) below the standalone RS code. Third, and most importantly, the Tornado advantage grows as \(p\) decreases because its curve is steeper: by \(p\approx0.036\) the improvement is already \(340\times\) over repetition and \(990\times\) over RS (Table 1). The concatenation does not merely shift the curve down, it bends it.

6 Asymptotic scaling↩︎

The slopes in Fig. 3 follow from counting the minimum-weight error that defeats each decoder. A code that corrects \(t\) errors first fails at weight \(t+1\), so its logical error rate scales as \(p_{\mathrm{L}}\propto p^{\,t+1}\) at small \(p\).

6.0.0.1 Repetition (\(d=3\)).

Majority vote fails at two flips out of three, so \(p_{\mathrm{L}}^{\mathrm{rep}}\approx 3p^{2}\): slope \(2\).

6.0.0.2 Reed–Solomon \([[21,9,6]]\).

The bounded-distance decoder corrects \(t=2\) bit flips and first fails at weight \(3\), so \(p_{\mathrm{L}}^{\mathrm{RS}}\sim A_3\, p^{3}\): slope \(3\). (The weight-\(3\) coset leaders in the table lower the prefactor \(A_3\) but do not change the exponent.)

6.0.0.3 Tornado \([[63,9,18]]\).

A logical failure requires the outer RS decoder to fail, i.e.at least \(t+1=3\) of the \(21\) effective bits to be wrong; each effective bit is wrong with probability \(q(p)\approx3p^{2}\) from Eq. 7 . Hence \[p_{\mathrm{L}}^{\mathrm{tor}} \;\sim\; \binom{21}{3}\,q(p)^{3} \;\approx\; \binom{21}{3}\,(3p^{2})^{3} \;=\; 3.6\times10^{4}\,p^{6}, \label{eq:p6}\tag{8}\] a slope of \(6\). A least-squares fit to the simulated Tornado data over \(p\in[0.03,0.06]\) gives a local slope of \(6.3\), consistent with Eq. 8 ; the small excess over \(6\) and the smaller measured prefactor both reflect the weight-\(3\) coset leaders, which correct a fraction of the three-block failures. More generally, concatenating an inner code whose failure probability scales as \(p^{a}\) with an outer code that first fails at \(b\) block errors yields an exponent \(a\,b\); here \(a=2\) (majority vote) and \(b=3\) (RS correcting two), giving \(6\).

It is worth being precise about what this exponent is and is not. The code distance \(d_X=18\) would, under an optimal decoder, permit correcting up to \(\lfloor(18-1)/2\rfloor=8\) errors and yield a slope of \(\lceil 18/2\rceil=9\). Our two-stage hard-decision decoder does not reach that: it fails already at \(6\) physical flips (two in each of three blocks), so its exponent is \(6\), not \(9\). The gap is the price of decoding the two layers independently and with hard decisions; a soft-decision decoder acting on the full \(63\)-qubit code could in principle recover the missing suppression. The \(p^{6}\) scaling is what the simple decoder we implement actually achieves; closing the gap to \(p^{9}\) is left for future work.

7 Discussion and limitations↩︎

7.0.0.1 Overhead is the cost of the steep slope.

The Tornado code’s low logical error rate is bought with qubits, and it is important to state this plainly. Table 2 lists the rates: the Tornado code has the lowest rate of the three, \(1/7\), below both the standalone RS code (\(3/7\)) and even the \(d=3\) repetition code (\(1/3\)). The Tornado code is not a free improvement over its parents at fixed qubit budget; it trades rate for a much steeper error suppression. The fair comparison is at fixed distance: a pure repetition code of distance \(18\) would need \(18\) physical qubits per logical qubit (rate \(1/18\approx0.056\)), whereas the Tornado code achieves the same distance-\(18\) protection at rate \(1/7\approx0.143\), a \(2.6\times\) improvement in encoding rate. This is the concrete sense in which folding a high-rate algebraic outer code into the concatenation is worthwhile: for a target distance it uses far fewer qubits than repetition alone. The same lesson motivates the high-rate outer codes in the cat-qubit architectures of Refs. [4], [10], [14].

7.0.0.2 Single-shot, code-capacity noise.

Our results are code-capacity results: a single round of \(X\) noise followed by noiseless syndrome extraction and readout. Real devices have faulty gates and measurements and require repeated syndrome rounds, under which an outer code with only \(d_Z=1\) and a static, single-shot decoder is not by itself fault-tolerant. Establishing a circuit-level threshold would require modelling CNOT and measurement noise, decoding over multiple rounds, and accounting for the residual phase-flip rate of the physical cat qubits (which sets the \(d_Z=1\) vulnerability). We view the present construction as a proof of concept, at the code-capacity level, for using high-rate classical codes on biased-noise qubits, not as a claim of fault tolerance.

7.0.0.3 Decoder cost and code families.

The lookup decoder is optimal but its table grows exponentially in the number of correctable errors, so it does not scale to large codes; a syndrome-based algebraic RS decoder or belief propagation would be needed there. Likewise, the three codes benchmarked here are single instances, not a family, so Fig. 3 exhibits finite-size scaling rather than a threshold. The construction is nonetheless parametric: the RS code \([15,9]\) over \(\mathrm{GF}(2^4)\) (primitive polynomial \(x^4+x+1\)) expands to a \([60,36]\) binary code with symbol distance \(7\) and binary distance at least \(7\), and the same Tornado wrapping applies to any member of the family. Mapping out a genuine threshold for a scalable Tornado family, and comparing it against quantum LDPC codes tailored to biased noise [14]–[16], is the natural next step.

7.0.0.4 Relation to prior and concurrent work.

Our construction sits at the intersection of three lines of work. Compared with the Grassl–Beth quantum RS codes [8], we trade generality (correction of both \(X\) and \(Z\)) for a Clifford circuit, simulable in Stim, that is matched exactly to the biased channel of the cat qubit. From classical Tornado codes [9] we keep only the layered philosophy, replacing the cascade of sparse graph codes with a single repetition layer beneath an algebraic outer code. Within the cat-qubit literature, concatenating biased qubits with a classical outer code is precisely the strategy behind repetition cat architectures [2], [4], [10], LDPC-cat codes [14], and bias-tailored LDPC codes [16]; the recent Elevator codes [17] likewise concatenate an inner repetition layer with a high-rate outer code under biased noise. Our contribution is a small, fully explicit, optimally decoded instance built from an MDS Reed–Solomon outer code, together with an account of its scaling and overhead.

8 Conclusion↩︎

Exploiting the noise bias of cat qubits, we built a Clifford-only quantum Reed–Solomon code, the \([[21,9,6]]\) bit-flip code, that avoids the non-Clifford quantum Fourier transform of the standard quantum RS construction and is simulable end-to-end in Stim. Wrapping each of its positions in a distance-three repetition code yields a \([[63,9,18]]\) Tornado code that, with a simple two-stage decoder, reaches a logical error rate of \(5.3\times10^{-3}\) at a physical error rate of \(0.1\) and suppresses errors as \(p^{6}\), far steeper than either parent code. The construction is a compact demonstration that the extreme noise asymmetry of bosonic qubits turns the rich toolbox of classical linear codes into directly usable Clifford quantum codes, and that concatenating a high-rate algebraic outer code with a simple inner code achieves steep error suppression at a modest cost in qubits. The clear next steps are to extend the analysis to circuit-level noise and to a scalable code family.

9 Reproducibility↩︎

All code, data, and figure scripts are available in the project repository at https://github.com/Coderrexe/MIT-iQuHACK-Winner-2026. The numerical results in this paper were reproduced independently of the original notebook using Python 3, stim 1.16.0, pymatching 2.4.0, numpy, and scipy; the original notebook pins stim \(\sim\) 1.15. Every construction constant was verified against a clean re-implementation: the primitive polynomial \(x^3+x+1\), the primitive element \(\alpha=2\), the evaluation points \((1,2,4,3,6,7,5)\), the generator \(G_{\mathrm{sym}}\) of Eq. 5 , the binary distance \(6\), and the \(1359\)-entry lookup table. The self-contained module figures/rs_tornado_lib.py rebuilds the code, \(H\), and the decoders; figures/make_data.py regenerates the benchmark data of Fig. 3 and Table 1; and the figures/fig_*.py scripts regenerate every figure.

10 Explicit code matrices↩︎

For completeness we give the code in fully explicit form, so that it can be reconstructed without running any code. The Gaussian elimination of Sec. 3 yields the systematic generator \(G_{\mathrm s}=[\,\mathrm{I}_9\mid P\,]\) with the \(9\times12\) parity block \[P = \setlength{\arraycolsep}{3.5pt} \begin{pmatrix} 1&1&0&0&1&0&1&0&0&1&1&0\\ 0&1&1&0&0&1&0&1&0&0&1&1\\ 1&1&1&1&1&0&0&0&1&1&1&1\\ 1&0&1&1&0&1&1&0&0&0&0&1\\ 1&0&0&1&0&0&0&1&0&1&1&0\\ 0&1&0&0&1&0&0&0&1&0&1&1\\ 1&1&1&0&1&1&1&0&0&0&1&1\\ 1&0&1&1&1&1&0&1&0&1&1&1\\ 1&0&0&1&0&1&0&0&1&1&0&1 \end{pmatrix}. \label{eq:Pexplicit}\tag{9}\] The parity-check matrix is \(H=[\,P^{\mathsf T}\mid\mathrm{I}_{12}\,]\) (Eq. 6 ), the \(12\) rows of which are the \(Z\)-type stabilizer supports; one verifies \(H\,G_{\mathrm s}^{\mathsf T}=0\) over \(\mathrm{GF}(2)\). The encoder places a CNOT from message qubit \(i\) to parity qubit \(9+j\) for every nonzero entry \(P_{ij}\) of Eq. 9 , sixty gates in total. A brute-force search over the \(2^{9}-1\) nonzero codewords of \(G_{\mathrm s}\) confirms the minimum distance \(6\).

11 Worked field arithmetic↩︎

In \(\mathrm{GF}(8)=\mathbb{F}_2[x]/(x^3+x+1)\) the relation \(x^3=x+1\) reduces higher powers. Writing elements as \(3\)-bit strings (little-endian in the powers of \(x\)), the element \(2=\texttt{010}=x\) generates the multiplicative group: \(x^{1}=2\), \(x^{2}=4\), \(x^{3}=x+1=3\), \(x^{4}=x^{2}+x=6\), \(x^{5}=x^{2}+x+1=7\), \(x^{6}=x^{2}+1=5\), \(x^{7}=1\), reproducing the evaluation points of Eq. 4 . Addition is xor: e.g.\(3\oplus3=(x{+}1)\oplus(x{+}1)=0\). Multiplication follows the shift-and-reduce rule; e.g. \(6\cdot6=(x^{2}{+}x)^{2}=x^{4}+x^{2}=x(x{+}1)+x^{2}=x=2\).

References↩︎