Quantum error correction on superconducting hardware: the fast clock and its price

In a previous note we argued that quantum error correction, not qubit count, decides when RSA and ECC fall. That note stayed at the level of algorithms and compilers. This one goes down to the metal: what error correction actually looks like on a superconducting chip, what such a chip has genuinely demonstrated, and what stands between that demonstration and a machine.

It starts from first principles — no prior knowledge of error correction assumed — and ends with the parts nobody puts on a roadmap slide. This is the first in a series looking at error correction platform by platform.

One qubit is not a reliable thing

A qubit is a physical object — in a superconducting processor, a small aluminium circuit on a silicon chip, cooled to about 10 millikelvin, where a current can flow in a superposition of two directions. Being physical, it is coupled to the world around it, and the world is noisy. Left alone, it decays. Act on it, and the action itself adds error.

The numbers are less bad than they used to be and still nowhere near good enough. On Google’s Willow processor, a qubit holds its state for roughly 68 microseconds on average before relaxing. A two-qubit gate — the workhorse operation — fails about 3 times in 1,000. A measurement is wrong about 8 times in 1,000. String a few thousand operations together and you are reading noise.

Useful algorithms do not need a few thousand operations. Breaking RSA-2048 needs on the order of a billion. The gap between what the hardware does and what the algorithm needs is roughly six orders of magnitude, and no plausible improvement in materials science closes it. So the field does not try to close it with better qubits alone. It closes it with error correction: blending many unreliable physical qubits into one reliable logical qubit.

That distinction is the single most important idea in the field, and it is why “how many qubits does it have?” is almost always the wrong question.

The classical trick: say it three times

Classical computers have the same problem in principle, and solved it long ago. If a bit might flip in transit, do not send one bit — send three:

0 → 000 and 1 → 111

If one of the three flips and 000 arrives as 010, the receiver takes a majority vote and recovers 0. The code fails only if two or more bits flip, which for small per-bit error probability is much less likely than one flipping. That is the repetition code, and its logic is the logic of all error correction: spread information across more carriers than strictly needed, so that a small number of failures leaves the message recoverable.

The number of failures a code tolerates is set by its distance. The three-bit repetition code has distance 3: you must flip 3 bits to turn a valid 000 into a valid 111, so any 1 error is correctable. Distance d corrects up to (d−1)/2 errors. Want more protection? Increase the distance. This is the dial the whole field turns.

Three reasons that trick should not work on a qubit

Applied naively to quantum information, the repetition code collapses immediately — for three separate reasons. Each looks fatal, and each has an escape.

1. You cannot copy a qubit. The no-cloning theorem forbids making |ψ⟩|ψ⟩|ψ⟩ from an unknown |ψ⟩. The escape: do not copy — entangle. Encode α|0⟩+β|1⟩ as α|000⟩+β|111⟩. No qubit holds a copy; the information lives in the correlations between them. Nothing is cloned, and yet it is spread out.
2. Looking destroys it. Measuring a qubit to check for errors collapses the superposition you were protecting. The escape: do not measure the qubits — measure the relationships between them. Ask “do qubits 1 and 2 agree?” That question has a yes/no answer that reveals nothing about α or β, so the superposition survives. The answers are called the syndrome.
3. Errors are continuous. A classical bit flips or does not. A qubit can rotate by 0.3 degrees, or any of a continuum of small deviations — and you cannot correct infinitely many errors with finitely many checks. The escape: the measurement that extracts the syndrome also digitises the error. Any single-qubit error can be written in terms of just three basic ones (bit flip X, phase flip Z, and both at once Y), and the syndrome measurement projects the messy continuous rotation onto one of them. Correct those, and you have corrected everything.

That third escape is the quiet miracle of the field. It means a quantum computer is fundamentally a digital machine, not an analogue one, and it is the reason quantum error correction is possible at all.

One genuinely new problem remains that classical codes do not have. Bits only flip. Qubits fail in two independent ways — the bit flip (X) and the phase flip (Z), a sign error with no classical analogue. A code must catch both. Peter Shor’s 1995 nine-qubit code did it by nesting a phase-flip repetition code inside a bit-flip one: 9 physical qubits to protect 1, correcting any single-qubit error. It was the proof that the thing was possible. It is not what anyone builds.

The surface code: a code shaped like a chip

What everyone builds — on superconducting hardware, at least — is the surface code. To understand why, look at the constraint the hardware imposes.

A superconducting processor is lithography. The qubits are patterned onto a two-dimensional die, and a qubit can only be coupled to a qubit it is physically next to. On Willow, average connectivity is 3.47 — each qubit touches roughly four neighbours, on a square grid, and nothing else. Any code that needs qubit 4 to talk to qubit 91 is not going to run on that chip.

The surface code is the code that asks for exactly what such a chip can give. Qubits sit on a 2D lattice in two roles: data qubits hold the encoded information, and measure qubits (ancillas) sit between them, each repeatedly interacting with its four nearest neighbours to extract one parity check. Half the ancillas check for bit flips, half for phase flips — the two error types the code must catch. Every operation is nearest-neighbour. Nothing reaches across the chip.

Run those checks over and over. Each round produces a syndrome: a pattern of which checks changed. An error somewhere in the lattice lights up the checks at the ends of its error chain, and a classical algorithm called a decoder takes that pattern and infers what most likely happened. The logical information is never touched, never measured, never observed. It sits in the global structure of the lattice while the machine gossips endlessly about parities.

The distance dial is now geometric: distance is the width of the patch. In the rotated planar variant — the one real devices use, which takes the plain planar code, turns it 45 degrees and discards the qubits that fall outside the square — a distance-d logical qubit costs d² data qubits and d²−1 measure qubits. So 2d²−1 physical qubits per logical qubit, and the protection grows with d.

The surface code did not win because it is efficient. It won because it is the code a flat chip can actually be wired for.

It is worth being clear about what that sentence concedes. The surface code has a terrible rate: it spends thousands of physical qubits to buy one good logical qubit, and it protects exactly one. Better codes exist on paper. The surface code’s advantage is that its demands and a lithographic chip’s abilities happen to be the same shape. We will come back to what that compromise costs.

The threshold: where more qubits start helping

Adding qubits is not automatically good. Every extra qubit is an extra thing that can break, and every extra check is more operations, each of which can inject an error. A code can easily make things worse.

Which way it goes is decided by the threshold. If the physical error rate is above it, adding distance adds more noise than it removes and the logical qubit gets worse the bigger you build it. If it is below, every increase in distance suppresses the logical error rate exponentially, and arbitrarily good logical qubits become an engineering problem rather than a physics one. This is the quantum threshold theorem, and for the surface code the threshold sits at roughly 1% per operation.

The practical measure of which side you are on is Λ (lambda): the factor by which the logical error rate falls each time distance increases by 2. Λ > 1 means below threshold. Λ ≤ 1 means the code is hurting you. Everything else in this article is downstream of that one number.

What superconducting hardware has actually done

In 2024 Google ran a distance-7 surface code on the 105-qubit Willow processor and measured Λ = 2.14 ± 0.02. Below threshold, on real hardware, for the first time. The result was published in Nature in 2025 and it is the reason this platform is taken seriously.

The measured figures are worth reading precisely, because they are usually reported loosely:

Two details deserve emphasis because they are routinely lost. First, break-even is measured against the best physical qubit in the patch, not the median. 291 µs against 119 µs gives 2.4×; against the 85 µs median it would be 3.4×. Google reported the harder number. Second, the two-qubit error rate above is from the QEC chip specifically. Google published two Willow chips with different tunings; the other, optimised for random-circuit sampling, reaches 0.14% two-qubit error but is not the one that ran the code. Comparing the sampling chip’s fidelity to the QEC chip’s result mixes two devices.

Since then the platform has kept moving. In December 2025 Google demonstrated magic-state cultivation on a Willow processor — growing the non-Clifford resource states that any useful algorithm consumes by the billion, at a fidelity of 0.9999 and a 40× error reduction, using a distance-3 colour code grafted onto a distance-5 surface code. It matters because the aggressive RSA and ECC resource estimates from the same group assume cultivation works. That assumption is now anchored to an experiment rather than a projection.

The multiplier is the story

So: below threshold, beyond break-even, 0.143% per cycle. How far is that from useful?

Take the measured Λ and extrapolate. To get from 0.143% per cycle down to a logical error rate of 10⁻⁶ — a modest target, and far short of what factoring needs — you need to climb from distance 7 to distance 27. At 2d²−1, that is about 1,457 physical qubits for one logical qubit. Google’s own framing (“more than a thousand physical qubits per surface code grid” for 10⁻⁶) agrees.

So a single useful logical qubit is a ~1,500-qubit object, and Willow has 105 qubits in total. That is the honest scale of the gap — and it is a gap in engineering, not in physics, which is precisely what below-threshold means. But it rests on Λ staying at 2.14 for another ten increases of distance, and that is where the interesting problems live.

The bill

The error rates the estimates assume have not been demonstrated

This is the sharpest gap and the least discussed. The resource estimates that produce headlines — under a million qubits for RSA-2048; under half a million for a 256-bit elliptic-curve key — assume a uniform physical error rate of 0.1%. The Willow QEC chip measured 0.33% two-qubit error and 0.77% readout error. The estimates therefore assume gates roughly 3× better, and measurements roughly 8× better, than the best chip that has actually run a surface code.

That is not a criticism of the estimates — they are explicit about their assumptions, and the assumptions are reasonable extrapolations. It is a caution about reading them as descriptions of present hardware. They describe a chip nobody has built yet, and the margin between 0.33% and the ~1% threshold is the entire reason error correction works at all today. Shrinking that gap to 0.1% is most of the remaining work.

Transmons are not two-level systems, and leakage is not a Pauli error

The whole edifice above rests on errors digitising into X, Y, Z. A transmon does not fully cooperate. It is not a two-level system but a weakly anharmonic oscillator — a ladder of levels, of which the bottom two are conscripted to serve as |0⟩ and |1⟩. The rungs above are close enough that operations occasionally push the qubit up into them.

That is leakage, and it is worse than an ordinary error for two reasons. It is invisible to a decoder built to reason about Pauli errors — a leaked qubit is not wrong, it is elsewhere. And in Google’s own words, leakage states are “long-lived and mobile,” which “opens a path to errors that are correlated in space and time.” Left alone, a leaked qubit stays leaked for something like 4 correction cycles on average, and the |2⟩ state can outlive 10 of them — all the while corrupting its neighbours through subsequent two-qubit gates, and sometimes leaking them too. Both halves of the surface code’s premise, that errors are local and independent, fail at once.

You can read the cost directly off the Willow result. Of the 101 qubits in the distance-7 patch, 4 do nothing but remove leakage, and the device runs multi-level reset as standard. Roughly 4% of the qubit budget goes to a failure mode that the textbook theory says does not exist.

The decoder has to keep up, forever

The surface code produces syndrome data continuously — a full lattice of parity checks every 1.1 microseconds, 909,000 times a second, and the decoder must consume it in real time. Not fast on average: fast enough that the backlog never grows. If decoding takes longer than a cycle, the queue lengthens without bound and the computation is over.

Google’s real-time decoder achieved 63 microseconds average latency at distance 5 over a million cycles. That is fine for a memory experiment. It is not fine for computation: the aggressive resource estimates assume a 10-microsecond reaction time — the round trip from measuring a syndrome to conditioning the next gate on it. The decoder is a hard real-time classical computing problem sitting inside a quantum one, and it gets harder as distance grows, because the syndrome volume grows with it.

IBM has been candid here in a way that is worth quoting. Its own engineers note that current work “focuses on error correction in quantum memory … rather than quantum processing,” and that “the decoding hardware available today is not compact enough for the kinds of logical operations we want to perform.”

The chip drifts

A superconducting processor is not a fixed machine. The amorphous oxides in and around the junctions host two-level-system defects — stray quantum systems that wander in frequency and, when one drifts onto a qubit’s frequency, quietly eat its coherence.

The magnitude is not marginal. In a study of 31,278 lifetime measurements spanning 400 MHz and 20 hours, Google found that a qubit’s T1 “can vary by up to an order of magnitude, and fluctuations between extrema can happen abruptly on 15-min time scales, and across 5-MHz frequencies.” The defects themselves diffuse across the spectrum at a measured rate of about 2.5 MHz per square-root-hour. A qubit that was excellent this morning can be mediocre by lunchtime, for reasons that are invisible from the outside and that move again by evening.

Error correction assumes a calibrated machine with known, stable error rates — that is exactly what the decoder’s noise model encodes. So the chip must be continuously re-characterised just to keep the decoder honest, and the same fluctuations are why frequent recalibration is a fact of life on these devices. Keeping 105 qubits inside that assumption is already a substantial automated effort. Doing it across a million, while they are all running and cannot be paused, is a problem that appears on no roadmap as a milestone.

Cosmic rays do not care about your code distance

This is the one that should worry people most, and it is the least known.

In 2021 Google instrumented a 26-qubit Sycamore device as a particle detector and watched. Roughly once every 10 seconds, something — a cosmic ray muon, or a gamma from ambient radioactivity — deposits between 100 keV and 1 MeV in the silicon substrate. For scale, the energy that matters to a transmon is about 25 µeV: the impact is ten orders of magnitude larger. The energy converts into a burst of phonons that races through the substrate, breaking Cooper pairs across the entire die.

The result is not a local error. It is chip-wide, near-total, and long. Every qubit is hit at once. Coherence collapses from ~15 µs to under 1 µs. And it takes about 25 milliseconds to recover — which, at a 1.1 µs cycle, is roughly 20,000 consecutive correction rounds during which the chip is simply not a quantum computer.

Code distance protects against a bounded number of errors, spread out. A cosmic ray puts an error on every qubit at once. No distance survives that.

This is the deepest problem on the list because it is not a matter of degree. Every other item is something you improve: better gates, better decoders, better calibration. Bursts attack the surface code’s foundational assumption — that errors are local and independent — and a code cannot out-scale a violation of its own premise. Google’s own paper is blunt: such an event is “unacceptable for any attempt at logical state preservation using QEC.”

Worse, the scaling runs the wrong way. Impact rate is proportional to die area. A bigger chip is a bigger target, while the damage stays chip-wide — so scaling up increases the hit rate without diluting the harm. And the problem has not gone away: in the below-threshold work itself, Google recorded six large error bursts over some three billion cycles of a distance-29 repetition code — roughly one an hour — setting a hard floor at 10⁻¹⁰ on a code that would otherwise have gone lower.

The rarity is what made this invisible for years. An event every few seconds is irrelevant next to a qubit lifetime of tens of microseconds — it never showed up in the coherence benchmarks everyone reported. But an algorithm that runs for hours is certain to be hit, many times over. The metric said nothing; the application says everything. Mitigations exist as directions rather than results: shielding, underground operation, phonon traps, gap engineering. None is a solved problem.

A million qubits is a refrigeration problem

Every qubit needs control and readout lines running from room-temperature electronics down to the coldest stage of a dilution refrigerator. Each line is a coaxial cable, and each cable is a thermal short between a warm world and a cold one. The budget they spend against is brutally small: at the mixing chamber, roughly 19 microwatts at 20 millikelvin.

A detailed engineering study from ETH Zurich puts the scale in perspective. Driving 50 qubits with individual control takes 124 RF lines — about 2.5 per qubit, since drive and flux lines are strictly one-to-one and only readout multiplexes. And the cables are not passive bystanders: running 66 of them raised the mixing-chamber temperature from 6.1 to 8.4 millikelvin. Sixty-six cables measurably warm the refrigerator.

The authors’ own extrapolation is the part worth sitting with. Their setup could support “at least 150 qubits” — and only around 400 even after driving flux offsets to near zero. Reaching 1,000 needs several dilution units. That study is from 2019 and refrigerators have grown since, with the largest now offering perhaps an order of magnitude more cooling power at the mixing chamber. It does not change the shape of the problem. A million physical qubits wired this way is not one machine but on the order of a hundred refrigerators, and recent analysis states the conclusion plainly: as qubit counts scale toward 10⁵–10⁶, “simply multiplying this approach is no longer feasible.”

The proposed fix is to move the control electronics inside the fridge — cryogenic CMOS at the 4-kelvin stage, where there are watts rather than microwatts to spend. The bind is arithmetic: even an optimistic few milliwatts per qubit, times ten thousand qubits, overruns a 4 K budget of a few watts by more than an order of magnitude. It is an active research programme, not a solved one, and it is why “just add qubits” is not a plan.

The code you are allowed to run

The flat chip that makes the surface code natural also locks you into it. IBM’s gross code — a quantum LDPC code, [[144,12,12]] — stores 12 logical qubits in 288 physical qubits where the surface code would need nearly 3,000 for the same error suppression. Ten times fewer qubits. The catch is connectivity: it needs a degree-6 graph, four short-range couplers plus two long-range ones, forming a structure that is not planar and needs at least two routing layers.

IBM has been refreshingly direct about the consequence: “the gross code requires more connectivity than our chips currently have.” The code outran the hardware, and IBM is now building hardware to catch up — Loon, announced in November 2025, exists to demonstrate the c-couplers that make degree-6 connectivity possible. As of mid-2026 the gross code’s advantage remains a simulation result; no bivariate bicycle code has been run on a superconducting device. Its first hardware test is scheduled for Kookaburra, and IBM’s own paper concedes the surface code’s threshold (~1%) is higher than the gross code’s (0.7%).

Which frames the real trade. Superconducting hardware is stuck with an inefficient code because it is the only one its geometry permits. The escape is not better qubits — it is more connectivity, and connectivity on a two-dimensional die is a wiring problem, not a physics one.

Why the platform still has the best claim

Set against that bill, one advantage: speed, and it is bigger than it looks.

A superconducting surface-code cycle takes about 1.1 microseconds. Trapped-ion and neutral-atom machines have far better native fidelities and far better connectivity — genuinely better qubits — but their cycle times are two to three orders of magnitude slower. Recent work from Google, the Ethereum Foundation and Stanford makes this the central architectural distinction: fast-clock architectures (superconducting, photonic) against slow-clock ones (neutral atom, ion trap).

The distinction has teeth. That paper’s estimate for breaking a 256-bit elliptic-curve key — fewer than 1,200 logical qubits and under 90 million Toffoli gates — compiles on a superconducting architecture, at 10⁻³ error and planar connectivity, to fewer than half a million physical qubits running in minutes. Minutes, not days. The same circuit on a slow-clock machine takes correspondingly longer, and the difference is not academic: a fast-clock cryptographically relevant machine could break a key inside the window in which a blockchain transaction sits in a public mempool. A slow-clock one could not. Same algorithm, same logical qubits — the clock decides whether the attack is live.

The trade is therefore clean. Superconducting qubits are worse, and they are wired worse, and they run about a thousand times faster. Since error correction is a race between the rate at which errors accumulate and the rate at which you can find and fix them, the clock is not a detail. It is the reason this platform got below threshold first.

An honest position, mid-2026

Below threshold is real. Beyond break-even is real. Magic-state cultivation is real. These are not press releases; they are measurements, and taken together they retire the question of whether error correction works on this platform. It does.

What has not happened is equally concrete. The best logical qubit yet built has an error rate of 0.143% per cycle, needs to reach roughly 10⁻⁶ to be useful, and lives on a 105-qubit chip that would need to grow to about 1,500 qubits to host one such qubit — and to a million to host a useful number of them. The physical error rates that the famous resource estimates assume are still 3× to 8× better than measured. And the headline results are memory — keeping one logical qubit alive. Computing with logical qubits at scale, the full fault-tolerant instruction set, is a later milestone on every roadmap that has one; IBM says as much in its own words, that today’s work addresses “quantum memory … rather than quantum processing.” Meanwhile, roughly once an hour, a particle from space erases everything.

The right reading is neither “it is imminent” nor “it is impossible.” It is that the target has changed shape. The question is no longer whether the physics permits a fault-tolerant machine — Λ = 2.14 settled that. It is whether the engineering permits it: wiring, refrigeration, calibration, real-time decoding, and rare correlated events that no code distance addresses. Those are hard problems. They are also the kind of problems that engineering has a track record of grinding down, on timescales measured in years rather than decades.

Where the work is

The pattern from our earlier note repeats here from the hardware side. Resource estimates fell by more than an order of magnitude between 2019 and 2025 with essentially unchanged hardware assumptions — the gains came from the compilation and error-correction layers. Willow’s below-threshold result tells the same story from below: Sycamore to Willow improved encoded error rates roughly 20× off only about 2× better physical operations. The leverage was in the code, the decoder and the leakage handling.

That layer — between a problem worth solving and a chip that can run it — is where our work at JoS QUANTUM sits. Whether a quantum computer helps with a risk model, a pricing engine or a grid optimisation is not decided by the qubit count in the press release. It is decided by how the problem compiles: what code the geometry permits, how many T-states the algorithm burns, how much of the machine goes to distillation, and whether the clock is fast enough to matter. Those are the questions worth asking of any hardware roadmap, on any platform.

Next in this series: the same analysis for trapped ions and neutral atoms — the slow-clock architectures, with much better qubits and a very different set of problems.