A Fault-Tolerant Million Qubit-Scale Distributed Quantum Computer

Junpyo Kim, Dongmoon Min, Jungmin Cho, Hyeonseong Jeong, Ilkwon Byun, Junhyuk Choi and 2 others

A useful quantum computer needs over a million physical qubits, but a single dilution refrigerator — the fridge that keeps qubits near absolute zero — can only cool about a hundred thousand of them, so the field's plan is to wire many fridges together; the trouble is that the links between fridges are slow, scarce, and error-prone, and they wreck the constant error-correction loop every qubit depends on, pushing the whole machine's error rate to a hopeless 1.0; this paper (Seoul National University) redesigns both halves of that loop for the multi-fridge world — cutting the error-check circuit's gate count and latency, and splitting the error decoder across two temperature stages so it keeps pace with the checks — and shows the combination is exactly what makes a fault-tolerant two-million-qubit machine possible, where dropping any single piece leaves it broken.

The argument in one glance

Problem

One fridge cannot hold enough qubits

A quantum computer that solves real problems — simulating the FeMo-co molecule behind nitrogen fixation, say — needs thousands of reliable LOGICAL qubits, each built from thousands of noisy PHYSICAL qubits by error correction. That is over a million physical qubits. But superconducting qubits must live near absolute zero inside a dilution refrigerator, and a single fridge has a fixed cooling budget: even with the best device technologies, it can host under 100,000 qubits before the heat of the control electronics exceeds what it can remove. The machine we need is 10× too big for the box we can build.
What people did

Wire many fridges together

The industry's answer (on Google's and IBM's public roadmaps) is a distributed quantum computer: many fridges, each holding its ~100,000 qubits, linked by long-range connections so the whole thing behaves as one machine. Cooling stops being the ceiling — add more fridges for more qubits. Qubits in different fridges are entangled through shared "EPR pairs," a special two-qubit resource that stands in for the direct gate you cannot run across the gap.
Why it fell short

The links between fridges poison the error-correction loop

Every qubit survives only because of a relentless loop: measure error hints (error syndrome measurement, ESM), decode them, correct — and the loop must finish before errors pile up. The inter-fridge links break it three ways. Entangling across fridges via an EPR pair takes ~391 nanoseconds at 4% error, versus a local gate's 33 nanoseconds at 0.19% — roughly 12× slower and 20× more error-prone. The physical links are far fewer than the qubits needing them, so qubits queue behind slow SWAP operations that pile on more error. And the decoder, to trace an error chain crossing a fridge boundary, must exchange a message every clock cycle at 55 nanoseconds each — so decoding falls hundreds of times behind the checks. Miss the deadline and the "backlog problem" spirals the whole machine to logical error 1.0: useless.
This paper's idea

Redesign both halves of the loop for the multi-fridge world

This paper (Seoul National University) fixes the error-check circuit AND the decoder together. For the checks (ESM): offload the expensive cross-fridge gate work to CLASSICAL post-processing (a simple XOR replaces a slow "distributed CZ"), overlap EPR-pair preparation with the checks in a pipeline, and replace the costly generic SWAP with an EPR-specialized one built from cheaper gates — 3.7× faster checks at 2.4× lower error. For the decoder (EDU): decode independent nine-patch neighborhoods in PARALLEL (an error chain can only reach so far), and split the work across temperature stages — decode the cross-fridge boundaries once at the warmer 300K stage while the intra-fridge bulk decodes at the cold 4K stage in parallel — for up to 685× faster decoding. Finally, run eight decoders with different settings and pick the best, cutting the decoder's error 6·10¹⁰×. Together they make a fault-tolerant TWO-million-qubit machine feasible — and the paper shows removing any single piece breaks it.

Why this problem is worth solving

Quantum error correction is the price of admission to useful quantum computing, and it is a savage one: because physical qubits are so error-prone, thousands of them are woven together to protect a single trustworthy logical qubit, through a loop that never stops running.

the ESM — the “measure” step of the correction loop. Around each block of data qubits sit ancilla (helper) qubits; a small quantum circuit entangles each ancilla with its neighboring data qubits and then measures it, and the pattern of measurements (the “syndrome”) reveals WHERE errors happened without disturbing the data itself. The loop runs ESM repeatedly, then decodes the syndromes to identify error chains, then corrects. Its iron constraint: each ESM round takes some time, and both the errors accumulated during a round and the decoding of a round must stay within budget, or the whole scheme unravels

keeps the logical qubit alive only if two clocks stay in sync — errors must not outpace the checks, and decoding must not outpace… no, must not FALL BEHIND the checks. Both conditions are hard even in one fridge. The paper’s target is the machine everyone actually wants: a million-plus physical qubits, which no single fridge can cool, so the qubits must be distributed — and distribution attacks both clocks at once.

The distributed design leans on

the mechanism for entangling two qubits that sit in different fridges, where you cannot run an ordinary two-qubit gate across the gap. An EPR pair is a pre-shared maximally-entangled pair of qubits — one in each fridge — that acts as a consumable resource: spend it, plus some local operations and classical communication, to effectively apply a gate between the distant qubits. The catch is that generating an EPR pair across the long, necessarily-thick inter-fridge link is slow (~391ns) and error-prone (~4%), and the links are far scarcer than the qubits that need them

, and that scarcity and slowness is where the trouble concentrates. The paper’s own baseline analysis is stark: run a state-of-the-art single-fridge control system on a distributed machine and the logical error rate is 1.0 — total failure — because the check circuit becomes too slow and error-prone, AND the decoder falls hundreds of times behind. Fixing only one does nothing; the contribution is that all six of its techniques are jointly necessary, and together they cross the line into fault-tolerance for the first time at this scale.

What people did before, and where it broke

Single-fridge scalable control (prior QCP/QCI designs). Careful work squeezing control electronics into one fridge’s cooling and error budget — but capped below 100,000 qubits, an order of magnitude short of a useful machine, with no answer for going bigger.
Multi-fridge hardware (industry roadmaps, EPR-pair links). Google, IBM and others show the distributed direction and build the inter-fridge entanglement, and compilers exist for small noisy distributed machines — but none confronts the fault-tolerant, million-qubit error- correction problem the distribution creates.
Fast spike-based decoders. Cheap, fast hardware decoders that “shoot spikes” between syndromes to pair them — but they decode patches one at a time (a collision problem blocks parallelism), assume cheap local communication, and greedily fall into local optima, so at million-qubit scale they are both too slow and too inaccurate.
Hierarchical and neural-ensemble decoders. Prior two-level decoders cut bandwidth or error WITHIN one fridge by decoding the same qubits twice; a neural ensemble picks one decoder via a trained classifier. Neither targets the cross-fridge communication bottleneck, and the neural approach cannot even scale to a single large patch. This paper’s hybrid and ensemble are differently shaped for exactly the multi-fridge failure.

How the redesigned loop works

Six techniques across the check circuit and the decoder

ESM #1 — quantum-classical hybrid check new

The baseline emulates a cross-fridge gate with a "distributed CZ" — many gates including two measurements and an EPR pair. Instead, generate one EPR pair, run the ordinary local check on each side, measure both ancillas IN PARALLEL, and recover the syndrome by XOR-ing the two results in CLASSICAL hardware. The expensive quantum coordination becomes a classical XOR: half the EPR pairs, far fewer gates.
↓ →
ESM #2 — pipelined EPR preparation new

EPR-pair preparation is still slow because three qubits must share one scarce link via SWAPs. Shift each fridge's qubit layout by one to free buffer qubits, so EPR preparation and the main check run in PARALLEL rather than in sequence — hiding the preparation latency behind useful work, at 0.067% qubit overhead.
↓ →
ESM #3 — EPR-specialized SWAP new

The generic SWAP that shuttles EPR pairs is three CZ + six H gates — slow and error-prone. The insight: when one qubit is part of an EPR pair and the other is in the zero state, a SWAP can be done with just one iSWAP plus one S† gate (the S† is a "virtual" Z-rotation, free and errorless). This special-case SWAP is 80% faster and 74% less error-prone.
↓ →
EDU #1 — parallel nine-patch decoding new

Prior decoders handle logical-qubit patches one at a time to avoid collisions (two decoders claiming the same syndrome). But a correctable error chain can span at most the immediately adjacent patches — nine, counting the center. So decode every nine-patch neighborhood independently and in parallel, all in the same fixed order to prevent collisions, turning decode time from growing with qubit count to constant.
↓ →
EDU #2 — 4K & 300K hybrid decoder new

The killer cost is cross-fridge boundary chains: the cold 4K decoder must exchange a message every cycle at 55ns, dominating 99.4% of decode latency. Fix the layout so only ONE patch straddles a boundary, then offload that patch to a decoder at the warmer 300K stage — one round-trip instead of per-cycle chatter — running in parallel with the 4K decoders on everything else. The 4K decoders now run at full clock speed.
↓ →
EDU #3 — ensemble decoding new

The fast spike decoder is greedy and lands in local optima: its answer flips with the order it processes syndromes and with which qubit type it prioritizes. So run EIGHT decoders in parallel with different orderings and priorities (2×2×2 settings), then pick the result with the shortest total error-chain length — a global-quality tiebreak the individual decoders lack. Accuracy up 6·10¹⁰×.

Evaluated against two real target applications: 3D Jellium (215,040 qubits, ~2030-era) and FeMo-co molecular simulation (2,138,112 qubits, ~2033-era), on surface-code error correction with lattice surgery, across dilution refrigerators cooling ~92,160 qubits each with only 11 inter-fridge links and 55ns cross-fridge latency. Decoders modeled in both 4K CMOS and superconducting ERSFQ; system-level latency validated against hardware simulation within ~7%.

The idea

When a resource is slow and scarce, move the work off it — even across the classical boundary. The unifying move in the three check-circuit techniques is to spend as little as possible on the inter-fridge link. The quantum-classical hybrid check is the purest instance: the coordination the baseline performs with expensive quantum gates and a second EPR pair is replaced by a classical XOR of two independent measurements — the quantum computer offloads to the classical computer the part that does not need to be quantum. Pipelining hides the link’s latency behind local work; the specialized SWAP shrinks what must cross it. The whole ESM redesign treats the inter-fridge EPR pair the way a systems engineer treats any slow, contended channel: minimize trips, overlap them with other work, and shrink each payload.

Parallelize by the physics of locality, then pay the one unavoidable long trip once. The decoder’s two latency fixes are both about not waiting. Nine-patch decoding exploits a hard physical fact — a correctable error chain simply cannot reach beyond adjacent patches — to turn a sequential, grows-with-size decode into a constant-time parallel one, the same reason a stencil computation parallelizes. The 4K/300K hybrid then confronts the single cost locality cannot remove: a chain that crosses a fridge boundary genuinely needs information from both sides. Rather than pay 55ns per cycle chattering across the link, it pays ONE round trip — load the boundary problem up to the 300K stage, decode it there while the cold stage decodes everything else, write the answer back. It is the same off-critical-path amortization this site keeps meeting: isolate the expensive dependency, do it once, and hide it behind parallel work.

Beat a greedy heuristic’s blind spots by voting, judged on a global metric. The accuracy fix is the most transferable idea. A fast spike decoder is greedy — it commits to a pairing based on local spike arrivals and gets stuck in local optima, and, tellingly, its mistakes depend on arbitrary choices (which syndrome to process first, which qubit type to trust). The ensemble turns that fragility into strength: run eight decoders that make those arbitrary choices differently, so their local optima differ, then select the one whose total error-chain length is smallest — a GLOBAL quality signal none of the individual greedy runs uses. It is the judge-panel pattern this site has seen elsewhere: cheap diverse attempts plus a global tiebreak recover most of the quality of an expensive optimal method (here, near-MWPM accuracy) while staying fast enough to meet the deadline.

One error chain crossing a fridge boundary

Following the correction loop across the gap

Two fridges, each holding ~92,160 qubits, joined by a handful of slow inter-fridge links. An error chain runs across the boundary between them. Numbers from the FeMo-co (2.1M-qubit) evaluation.

Step 1 of 5

The baseline check is too slow and too dirty

To check a boundary region, the baseline runs a "distributed CZ" for every cross-fridge interaction: an EPR pair, two measurements, a pile of gates. For the inter-fridge qubits this means a 4,415ns check at 3% error per round — and because every merged qubit must wait for the slowest check, this poisons the whole round. Errors accumulate faster than the checks can catch them.

a local gate is 33ns/0.19%; the cross-fridge EPR path is ~391ns/4% — the asymmetry the whole design fights
all merged qubits synchronize to the worst-case check latency, so one slow region drags everyone

Why it works

The inter-fridge link is slow, scarce, and error-prone → the check redesign minimizes trips across it (classical XOR instead of distributed CZ), overlaps them with local work (pipelining), and shrinks each (specialized SWAP) → checks become 3.7× faster and 2.4× cleaner, near single-fridge quality.
A correctable error chain cannot reach beyond adjacent patches → each nine-patch neighborhood can be decoded independently in parallel → decode time stops scaling with the qubit count, and only the local window is activated, cutting energy too.
A boundary-crossing chain genuinely needs both fridges’ data → paying one round trip to a 300K decoder beats chattering every cycle, and it runs in parallel with the 4K interior decode → the 99.4%-of-latency bottleneck drops 98.5%, clearing the backlog.
A greedy spike decoder’s errors depend on arbitrary local choices → running eight variants diversifies their local optima, and picking the shortest total chain applies a global quality metric → near-optimal accuracy at heuristic speed, meeting the deadline.
All three failure factors (check error, decode latency, decode accuracy) must be fixed at once → the ablation shows removing any single fix returns logical error to failure → fault-tolerance emerges only from the full co-design, not any one trick.

What it costs

It is a design study, not a machine. Every number comes from modeling and simulation of assumed future device technologies — aggressively voltage-scaled cryogenic CMOS, or a superconducting ERSFQ decoder needing ~200 million Josephson junctions — that do not yet exist at the required maturity, though the paper argues fabrication trends are close.
The ensemble is not free. Eight parallel decoders cost ~8× the decode energy of one (still 24× below the greedy baseline, and only 7.5% of total power) and eight times the decoder area — a real hardware multiplier accepted to buy the accuracy.
A new synchronization problem. Splitting the decoder across 300K and 4K stages demands tight timing coordination between temperature domains that the paper flags as unsolved future work.
Still short of the gold standard. The ensemble decoder reaches an effective distance of 11 where optimal minimum-weight-perfect-matching hits 16, and the gap widens at lower physical error — accepted because MWPM decoders are an order of magnitude too slow or cannot scale to this code size at all.
Assumes the qubits and links exist. The work takes as given the inter-fridge EPR entanglement, the per-fridge qubit counts, and the error rates of a ~2030–2033 machine; it solves the error-handling layer atop a hardware stack still being built.

The evaluation

Modeled against two real fault-tolerant workloads — 3D Jellium (215,040 qubits) and FeMo-co molecular simulation (2,138,112 qubits) — with surface-code correction and lattice surgery, decoders in both 4K CMOS and ERSFQ, and system-level latency validated against multi-patch hardware simulation.

Making error correction survive across fridges

Property	Single-fridge control (prior art, applied naively)	Fast spike / hierarchical / neural decoders
Error-check circuit across fridges		Not addressed (decoder-only work)
Decoding speed vs the check deadline
Decoding accuracy	Greedy spike decoder falls into local optima
Result at target scale	Fails (logical error 1.0) on both 215K- and 2.1M-qubit targets	Insufficient on one or more of speed/accuracy
Necessity of the full set	—	—

Generality checks: the solutions hold across different physical error rates, gate types (CZ/CNOT/CR), fridge counts, and link-sharing degrees. Power: the redesigned decoder draws 3.8× the baseline (from 685× faster decode + 8× ensemble) but remains just 7.5% of total system power. System-level latency model validated within ~7% of hardware simulation.Underlined values explain themselves when clicked.

Where this stops working

What to keep in mind

This is a simulation-and-modeling study of a machine that does not exist: it assumes future cryogenic CMOS or a 200-million-Josephson-junction ERSFQ decoder, and takes the inter-fridge entanglement, per-fridge qubit counts, and ~2030–2033 error rates as givens rather than demonstrating them. The wins are real within that model — validated against hardware simulation to ~7% on latency — but they are projections. The design also accepts genuine costs: 8× decode energy and area for the ensemble, an unsolved 300K/4K synchronization problem, and a decoder still weaker than optimal matching (effective distance 11 vs 16), justified only because matching decoders are far too slow or unscalable here. And the whole result rests on the ablation’s claim that all six pieces are jointly necessary — a strength (nothing is redundant) that is also a fragility (nothing has slack).

Background

The move-it-off-the-slow-channel playbook, in a fridge

This is the site’s fourth quantum-computing entry, and it shares DNA with the others while reaching a new scale. Its decoder accuracy fix — run cheap diverse attempts, judge them on a global metric, keep the best — is the judge-panel / ensemble pattern the site keeps finding, here rescuing a greedy heuristic from its local optima the way the better-than-worst-case decoder page rethinks the same spike-decoding hardware, and echoing the diverse-attempts logic elsewhere on this site. Two systems threads run through it hard. The first is move-the-work-off-the-slow-scarce- channel: the inter-fridge EPR link is treated exactly as the on-NIC-memory page treats the PCIe bus and the heterogeneous- storage page treats a slow tier — minimize trips, overlap them, shrink each, and push whatever can be classical to the classical side. The second is off-critical-path amortization: paying one 300K round trip and hiding it behind parallel 4K work is the same isolate-the-expensive-dependency-and-do-it- once discipline as the inference-serving and cooling pages’ timescale splits. And the nine-patch parallelism is pure locality-gives-parallelism, the reason stencils and, on this site, the qubit-reuse page’s graph reasoning scale. Quantum hardware, classical systems instincts.

If you remember only three things

1. A useful quantum computer needs 1M+ physical qubits but one dilution refrigerator cools under 100K, so qubits must be distributed across many fridges — and the inter-fridge links (entangling two qubits via an EPR pair is ~12× slower and ~20× more error-prone than a local gate, the links are scarce, and the decoder waits 55ns per cross-fridge message) wreck the perpetual error-correction loop, pushing a naively-ported single-fridge design to a hopeless logical error rate of 1.0.
2. The paper redesigns both halves of the loop for the multi-fridge world: the error-check circuit spends less on the slow link (a classical XOR replaces the "distributed CZ", EPR preparation pipelines behind local work, an EPR-specialized SWAP replaces the heavy generic one) for 3.7×-faster/2.4×-cleaner checks; and the decoder wins on speed via locality (parallel nine-patch decoding, since chains can't reach far) plus a 4K/300K hybrid that pays the one unavoidable cross-fridge trip once and hides it, and on accuracy via an 8-way ensemble judged on shortest total error-chain length (6·10¹⁰× better).
3. Together the six techniques make a fault-tolerant TWO-million-qubit machine feasible in simulation (meeting logical-error targets for both 3D Jellium and FeMo-co, decoder just 7.5% of power) — with the ablation showing every piece is jointly necessary, and the honest caveats that it is a modeling study of not-yet-built cryogenic hardware, the ensemble costs 8× energy and area, and the decoder is still weaker than optimal matching (which is simply too slow to use here).

Check yourself

Check your understanding

1. A state-of-the-art single-fridge control system, ported unchanged to a multi-fridge machine, produces a logical error rate of exactly 1.0 — total failure. Predict the two independent failure modes the inter-fridge links create.
2. The quantum-classical hybrid check replaces a "distributed CZ" — many quantum gates plus a second EPR pair — with running the ordinary local check on each side and XOR-ing the two measurement results in classical hardware. Why is this the template for the whole check redesign?
3. The decoder gets two separate latency fixes: parallel nine-patch decoding, and a 4K/300K hybrid. Predict why the SECOND is needed even after the first, and what determines its shape.
4. The fast spike decoder is cheap but greedy, landing in local optima. The ensemble runs eight copies with different settings and picks the best. Predict why merely running eight greedy decoders helps, and what makes the selection work.

Sources

ACM DL: A Fault-Tolerant Million Qubit-Scale Distributed Quantum Computer — ASPLOS 2024