\section{Experimental quantum information processors}  \lab{s:qip}

The most elementary quantum logical operations have been demonstrated in 
many physics experiments during the past 50 years. For example, the {\sc 
not} operation ($X$) is no more than a stimulated transition between two 
energy levels $\ket{0}$ and $\ket{1}$. The important {\sc xor} operation 
can also be identified as a driven transition in a four-level system. 
However, if we wish to contemplate a quantum computer it is necessary to 
find a system which is sufficiently controllable to allow quantum logic 
gates to be applied at will, and yet is sufficiently complicated to store 
many qubits of quantum information. 

It is very hard to find such systems. One might hope to fabricate quantum 
devices on solid state microchips---this is the logical progression of the 
microfabrication techniques which have allowed classical computers to 
become so powerful. However, quantum computation relies on complicated 
interference effects and the great problem in realising it is the problem 
of noise. No quantum system is really isolated, and the coupling to the 
environment produces decoherence which destroys the quantum computation. In 
solid state devices the environment is the substrate, and the coupling to 
this environment is strong, producing typical decoherence times of the 
order of picoseconds. It is important to realise that it is not enough to 
have two different states $\ket{0}$ and $\ket{1}$ which are themselves 
stable (for example states of different current in a superconductor): we 
require also that superpositions such as $\ket{0} + \ket{1}$ preserve their 
phase, and this is typically where the decoherence timescale is so short. 

At present there are two candidate systems which should permit quantum 
computation on 10 to 40 qubits. These are the proposal of Cirac and Zoller 
(1995) using a line of singly charged atoms confined and cooled in vacuum 
in an ion trap, and the proposal of Gershenfeld and Chuang (1997), and 
simultaneously Cory {\em et. al.} (1996), using the methods of bulk nuclear 
magnetic resonance. In both cases the proposals rely on the impressive 
efforts of a large community of researchers which developed the 
experimental techniques. Previous proposals for experimental quantum 
computation (Lloyd 1993, Berman {\em et. al.} 1994, Barenco {\em et. al.}
1995a, DiVincenzo 1995b) touched on some of the important 
methods but were not experimentally feasible. Further recent proposals
(Privman {\em et. al.} 1997, Loss and DiVincenzo 1997) may become
feasible in the near future.

\subsection{Ion trap}

The ion trap method is illustrated in fig. 12,
and described in detail by Steane (1997b). A string
of ions is confined by a combination of oscillating and static electric
fields in a linear `Paul trap' in high vacuum ($10^{-8}$ Pa).
A single laser beam is split by beam splitters and acousto-optic
modulators into many beam pairs, one pair illuminating each ion.
Each ion has two long-lived states, for example
different levels of the ground state hyperfine structure (the
lifetime of such states against spontaneous decay can exceed thousands
of years). Let us refer to these two states as $\ket{g}$ and $\ket{e}$;
they are orthogonal and so together represent one qubit.
Each laser beam pair can drive coherent Raman transitions
between the internal states of the relevant ion. This allows
any single-qubit quantum gate to be applied to any ion, but not
two-qubit gates. The latter requires an interaction between ions,
and this is provided by their Coulomb repulsion. However, exactly
how to use this interaction is far from obvious; it required the
important insight of Cirac and Zoller.

Light carries not only energy but also momentum, so whenever a
laser beam pair interacts with an ion, it exchanges momentum with the ion. In 
fact, the mutual repulsion of the ions means that the whole string of ions 
moves {\em en masse} when the motion is quantised (M\"ossbauer effect).
The motion of
the ion string is quantised because the ion string is confined in the
potential provided by the Paul trap. The quantum states of motion
correspond to the different degrees of excitation (`phonons')
of the normal modes of vibration of the string.
In particular we focus on the ground state of the motion $\ket{n=0}$
and the lowest excited state $\ket{n=1}$ of the fundamental mode.
To achieve, for example, controlled-$Z$ between
ion $x$ and ion $y$, we start with the motion in the ground state
$\ket{n=0}$. A pulse of the laser beams on ion $x$ drives
the transition $\ket{n=0}\ket{g}_x \rightarrow \ket{n=0}\ket{g}_x$,
$\ket{n=0}\ket{e}_x \rightarrow \ket{n=1}\ket{g}_x$, so the ion
finishes in the ground state, and the motion finishes in the initial
state of the ion: this is a `swap' operation. Next a pulse
of the laser beams on ion $y$ drives the transition
  \begin{eqnarray*}
\ket{n=0}\ket{g}_y &\rightarrow& \ket{n=0}\ket{g}_y \\
\ket{n=0}\ket{e}_y &\rightarrow& \ket{n=0}\ket{e}_y \\
\ket{n=1}\ket{g}_y &\rightarrow& \ket{n=1}\ket{g}_y \\
\ket{n=1}\ket{e}_y &\rightarrow& -\ket{n=1}\ket{e}_y
  \end{eqnarray*}
Finally, we repeat the initial pulse on ion $x$. The overall effect
of the three pulses is
   \begin{eqnarray*}
\ket{n=0}\ket{g}_x\ket{g}_y &\rightarrow& \ket{n=0}\ket{g}_x\ket{g}_y \\
\ket{n=0}\ket{g}_x\ket{e}_y &\rightarrow& \ket{n=0}\ket{g}_x\ket{e}_y \\
\ket{n=0}\ket{e}_x\ket{g}_y &\rightarrow& \ket{n=0}\ket{e}_x\ket{g}_y \\
\ket{n=0}\ket{e}_x\ket{e}_y &\rightarrow& -\ket{n=0}\ket{e}_x\ket{e}_y \\
  \end{eqnarray*}
which is exactly a controlled-$Z$ between $x$ and $y$. 
Each laser pulse must have a precisely controlled frequency and
duration. The controlled-$Z$ gate and the single-qubit
gates together provide a universal set, so we can perform arbitrary
transformations of the joint state of all the ions!

To complete the prescription for a quantum computer (section \ref{s:uqc}),
we must be able to prepare the initial state and measure the final
state. The first is possible through the methods of optical pumping
and laser cooling, the second through the `quantum jump' 
or `electron shelving' measurement
technique. All these are powerful techniques developed in the
atomic physics community over the past twenty years. However, the
combination of all the techniques at once has only been achieved
in a single experiment, which demonstrated preparation, quantum
gates, and measurement for just a single trapped ion (Monroe {\em et. al}
1995b). 

The chief experimental difficulty in the ion trap method is to cool the 
string of ions to the ground state of the trap (a sub-microKelvin 
temperature), and the chief source of decoherence is the heating of this 
motion owing to the coupling between the charged ion string and noise 
voltages in the electrodes (Steane 1997, Wineland {\em et. al.} 1997). It is 
unknown just how much the heating can be reduced. A conservative statement 
is that in the next few years 100 quantum gates could be applied to a few 
ions without losing coherence. In the longer term one may hope for an order 
of magnitude increase in both figures. It seems clear that an ion trap 
processor will never achieve sufficient storage capacity and coherence to 
permit factorisation of hundred-digit numbers. However, it would be 
fascinating to try a quantum algorithm on just a few qubits (4 to 10) and 
thus to observe the principles of quantum information processing at work. We 
will discuss in section \ref{s:qec} methods which should allow the number of 
coherent gate operations to be greatly increased. 

\subsection{Nuclear magnetic resonance}

The proposal using nuclear magnetic resonance (NMR) is illustrated in fig. 
13. The quantum processor in this case is a molecule containing a `backbone' 
of about ten atoms, with other atoms such as hydrogen attached so as to use 
up all the chemical bonds. It is the nuclei which interest us. Each has a 
magnetic moment associated with the nuclear spin, and the spin states 
provide the qubits. The molecule is placed in a large magnetic field, and 
the spin states of the nuclei are manipulated by applying oscillating 
magnetic fields in pulses of controlled duration. 

So far, so good. The problem is that the spin state of the nuclei of a 
single molecule can be neither prepared nor measured. To circumvent this 
problem, we use not a single molecule, but a cup of liquid containing some 
$10^{20}$ molecules! We then measure the average spin state, which can be 
achieved since the average oscillating magnetic moment of all the nuclei is 
large enough to produce a detectable magnetic field. 
Some subtleties enter at this point. Each of the molecules in
the liquid has a very slightly different local magnetic field,
influenced by other molecules in the vicinity, so each `quantum
processor' evolves slightly differently. This problem 
is circumvented by the spin-echo technique, a standard tool in NMR
which allows the effects of free evolution of the spins to be reversed, 
without reversing the effect of the quantum gates. However, this 
increases the difficulty of applying long sequences of quantum gates. 

The remaining problem is to prepare the initial state. The cup of liquid is 
in thermal equilibrium to begin with, so the different spin states have 
occupation probabilities given by the Boltzman distribution. One makes use 
of the fact that spin states are close in energy, and so have nearly equal 
occupations initially. Thus the density matrix $\rho$ of the $O(10^{20})$ 
nuclear spins is very close to the identity matrix $I$. It is the small {\em 
difference} $\Delta = \rho - I$ which can be used to store quantum 
information. Although $\Delta$ is not the density matrix of any quantum 
system, it nevertheless transforms under well-chosen field pulses in the same 
way as a density matrix would, and hence can be considered to represent an 
effective quantum computer. The reader is referred to Gershenfeld and Chuang 
(1997) for a detailed description, including the further subtlety that an 
effective pure state must be distilled out of $\Delta$ by means of a pulse 
sequence which performs quantum data compression. 

NMR experiments have for some years routinely achieved
spin state manipulations and measurements equivalent in
complexity to those required for quantum information processing
on a few qubits, therefore the first few-qubit quantum processors 
will be NMR systems. The method does not scale very well as the
number of qubits is increased, however. For example, with
$n$ qubits the measured signal scales as $2^{-n}$. Also
the possibility to measure the state is limited, since only
the average state of many processors is detectable. This restricts
the ability to apply quantum error correction (section \ref{s:qec}),
and complicates the design of quantum algorithms.

\subsection{High-$Q$ optical cavities}

Both systems we have described permit simple quantum information 
processing, but not quantum communication. However, in a very high-quality 
optical cavity, a strong coupling can be achieved between a single atom or 
ion and a single mode of the electromagnetic field. This coupling can be 
used to apply quantum gates between the field mode and the ion, thus 
opening the way to transferring quantum information between separated ion 
traps, via high-$Q$ optical cavities and optical fibres (Cirac {\em et. 
al.} 1997). Such experiments are now being contemplated. The required 
strong coupling between a cavity field and an atom has been demonstrated by 
Brune {\em et. al.} (1994), and Turchette {\em et. al.} (1995). An 
electromagnetic field mode can also be used to couple ions within a single 
trap, providing a faster alternative to the phonon method (Pellizzari {\em 
et. al.} 1995). 

\section{Quantum error correction} \lab{s:qec}

In section \ref{s:qa} we discussed some beautiful quantum algorithms. Their 
power only rivals classical computers, however, on quite large problems, 
requiring thousands of qubits and billions of quantum gates (with the 
possible exception of algorithms for simulation of physical systems). In 
section \ref{s:qip} we examined some experimental systems, and found that 
we can only contemplate `computers' of a few tens of qubits and perhaps 
some thousands of gates. Such systems are not `computers' at all because 
they are not sufficiently versatile: they should at best be called modest 
quantum information processors. Whence came this huge disparity between the 
hope and the reality? 

The problem is that the prescription for the universal quantum computer, 
section \ref{s:uqc}, is unphysical in its fourth requirement. There is no 
such thing as a perfect quantum gate, nor is there such a thing as an 
isolated system. One may hope that it is possible in principle to achieve 
any degree of perfection in a real device, but in practice this is an 
impossible dream. Gates such as {\sc xor} rely on a coupling between 
separated qubits, but if qubits are coupled to each other, they will 
unavoidably be coupled to something else as well (Plenio and Knight 1996). 
A rough guide is that it is very hard to find a system in which the loss of 
coherence is smaller than one part in a million each time a {\sc xor} gate 
is applied. This means the decoherence is roughly $10^7$ times too fast to 
allow factorisation of a 130 digit number! It is an open question whether 
the laws of physics offer any intrinsic lower limit to the decoherence 
rate, but it is safe to say that it would be simpler to speed up classical 
computation by a factor of $10^6$ than to achieve such low decoherence in a 
large quantum computer. Such arguments were eloquently put forward by 
Haroche and Raimond (1996). Their work, and that of others
such as Landauer (1995,1996) sounds a helpful note of caution.
More detailed treatments of decoherence in quantum computers are given
by Unruh (1995), Palma {\em et. al.} (1996) and Chuang {\em et. al.}
(1995). Large numerical studies are described by
Miquel {\em et. al.} (1996) and Barenco {\em et. al.} (1997).

Classical computers are reliable not because they are perfectly
engineered, but because they are insensitive to noise. One way
to understand this is to examine in detail a device such as
a flip-flop, or even a humble mechanical switch. Their stability
is based on a combination of amplification and dissipation: a small
departure of a mechanical switch from `on' or `off' results in a large
restoring force from the spring. Amplifiers do the corresponding job in
a flip-flop. The restoring force is not sufficient
alone, however: with a conservative force, the switch would oscillate
between `on' and `off'. It is important also to have damping, supplied
by an inelastic collision which generates heat in the case of
a mechanical switch, and by resistors in the electronic flip-flop.
However, these methods are ruled out for a quantum computer
by the fundamental principles of quantum mechanics. The no-cloning
theorem means amplification of unknown quantum states is impossible,
and dissipation is incompatible with unitary evolution. 

Such fundamental considerations lead to the widely accepted belief that 
quantum mechanics rules out the possibility to stabilize a quantum computer 
against the effects of random noise. A repeated projection of the computer's
state by well-chosen measurements is not in itself sufficient 
(Berthiaume {\em et. al.} 1994, Miquel {\em et. al} 1997).
However, by careful application of 
information theory one can find a way around this impasse. The idea is to 
adapt the error correction methods of classical information theory to the 
quantum situation. 

Quantum error correction (QEC) was established as an important and general 
method by Steane (1996b) and independently Calderbank and Shor (1996). Some 
of the ideas had been introduced previously by Shor (1995b) and Steane 
(1996a). They are related to the `entanglement purification' 
introduced by Bennett {\em et. al.} (1996a) and independently Deutsch {\em 
et. al.} (1996). The theory of QEC was further advanced by Knill and 
Laflamme (1997), Ekert and Macchiavello (1996),
Bennett {\em et. al.} (1996b). The latter paper describes 
the optimal 5-qubit code also
independently discovered by Laflamme {\em et. al.} (1996).
Gottesman (1996) and Calderbank {\em et. al.} (1997) 
discovered a general group-theoretic framework, introducing the important 
concept of the stabilizer, which also enabled many more codes to be found
(Calderbank {\em et. al.} 1996, Steane 1996cd). Quantum coding theory reached
a further level of maturity with the discovery by Shor and Laflamme (1997)
of a quantum analogue to the MacWilliams identities of classical coding
theory.

QEC uses networks of quantum gates and measurements, and at first is was 
not clear whether these networks had themselves to be perfect in order for 
the method to work. An important step forward was taken by Shor (1996) and 
Kitaev (1996) who showed how to make error correcting networks tolerant of 
errors within the network. In other words, such `fault tolerant' networks 
remove more noise than they introduce. Shor's methods were generalised by 
DiVincenzo and Shor (1996) and made more efficient by Steane (1997a,c). Knill 
and Laflamme (1996) introduced the idea of `concatenated' coding, which is 
a recursive coding method. It has the advantage of allowing arbitrarily 
long quantum computations as long as the noise per elementary operation is 
below a finite threshold, at the cost of inefficient use of quantum memory 
(so requiring a large computer). This threshold result was derived by 
several authors (Knill {\em et al} 1996, Aharonov and Ben-Or 1996, 
Gottesman {\em et. al.} 1996). Further fault tolerant methods are described
by Knill {\em et. al.} (1997), Gottesman (1997), Kitaev (1997).

The discovery of QEC was roughly simultaneous
with that of a related idea which also permits 
noise-free transmission of quantum states over a noisy quantum channel. 
This is the `entanglement purification' (Bennett {\em et. al.} 1996a, Deutsch 
{\em et. al.} 1996). The central idea here is for Alice to generate many 
entangled pairs of qubits, sending one of each pair down the noisy channel 
to Bob. Bob and Alice store their qubits, and perform simple parity
checking measurements: for example, Bob's performs {\sc xor} between
a given qubit and the next he receives, then measures just the target qubit.
Alice does the same on her qubits, and they compare results. If they agree, the 
unmeasured qubits are (by chance) closer than average to the desired state 
$\ket{00} + \ket{11}$. If they disagree, the qubits are rejected. 
By recursive use of such checks,
a few `good' entangled pairs are distilled out of the many noisy ones. Once in 
possession of a good entangled state, Alice and Bob can communicate by 
teleportation. A thorough discussion is given by Bennett {\em et. al.} (1996b). 

Using similar ideas, with important improvements, van Enk {\em et. al.} 
(1997) have recently shown how quantum information might be reliably 
transmitted between atoms in separated high-$Q$ optical cavities via imperfect 
optical fibres, using imperfect gate operations. 

I will now outline the main principles of QEC.

Let us write down the 
worst possible thing which could happen to a single qubit: a completely 
general interaction between a qubit and its environment is
  \begin{eqnarray}
\ket{e_i}\left(a\ket{0} + b \ket{1} \right) \! &\rightarrow& \!
a\left(c_{00}\ket{e_{00}}\ket{0} + c_{01}\ket{e_{01}} \ket{1}\right) 
\nonumber \\
&& \rule{-8ex}{0em}
 + b\left(c_{10}\ket{e_{10}}\ket{1} + c_{11}\ket{e_{11}} \ket{0} \right)
  \end{eqnarray}
where $\ket{e_{\ldots}}$ 
denotes states of the environment and $c_{\ldots}$ are coefficients
depending on the noise.
The first significant point is to notice 
that this general interaction can be written
  \beq
 \ket{e_i} \ket{\phi}
\rightarrow \left(\ket{e_I} I + \ket{e_X} X + \ket{e_Y} Y
+ \ket{e_Z} Z \right) \ket{\phi}      \lab{IXYZ}
  \eeq
where $\ket{\phi} = a\ket{0} + b\ket{1}$ is the initial state of the
qubit, and $\ket{e_I} = c_{00}\ket{e_{00}} + c_{10}\ket{e_{10}}$,
$\ket{e_X} = c_{01}\ket{e_{01}} + c_{11}\ket{e_{11}}$, and so on.
Note that these environment states are not necessarily normalised.
Eq. (\ref{IXYZ}) tells us that we have essentially three types
of error to correct on each qubit: $X$, $Y$ and $Z$ errors. These
are `bit flip' ($X$) errors, phase errors ($Z$) or both ($Y=XZ$).

Suppose our computer $q$ is to manipulate $k$ qubits of quantum
information. Let a general state of the $k$ qubits be $\ket{\phi}$.
We first make the computer larger, introducing a further $n-k$
qubits, initially in the state $\ket{0}$. Call the enlarged
system $qc$. An `encoding' operation
is performed: $E (\ket{\phi} \ket{0}) = \ket{\phi_E}$. Now, let
noise affect the $n$ qubits of $qc$. Without loss of generality, the
noise can be written as a sum of `error operators' $M$, where each
error operator is a tensor product of $n$ operators (one for
each qubit), taken from the set $\{I,X,Y,Z\}$. For example
$M = I_1 X_2 I_3 Y_4 Z_5 X_6 I_7$ for the case $n=7$. A general noisy
state is
  \beq
\sum_s \ket{e_s} M_s \ket{\phi_E}   \lab{noise}
  \eeq
Now we introduce even more qubits: a further $n-k$, prepared in
the state $\ket{0}_a$. This additional set is called an `ancilla'. 
For any given encoding $E$, there exists a {\em syndrome extraction}
operation $A$, operating on the joint system of $qc$ and $a$.
whose effect is $A (M_s \ket{\phi_E} \ket{0}_a)
= (M_s \ket{\phi_E}) \ket{s}_a$ $\forall \; M_s \in {\cal S}$.
The set $\cal S$ is the set of correctable errors, which depends
on the encoding. In the notation $\ket{s}_a$, $s$ is just a binary
number which indicates which error operator $M_s$ we are dealing
with, so the states $\ket{s}_a$ are mutually orthogonal.
Suppose for simplicity that the general noisy state (\ref{noise})
only contains $M_s \in \cal S$, then the joint state of
environment, $qc$ and $a$ after syndrome extraction is
  \beq
\sum_s \ket{e_s} \left( M_s \ket{\phi_E} \right) \ket{s}_a 
  \eeq
We now measure the ancilla state, and something rather wonderful
happens: the whole state collapses onto
$\ket{e_s} \left( M_s \ket{\phi_E} \right) \ket{s}_a$,
for some particular value of $s$. Now, instead of general noise,
we have just one particular error operator $M_s$ to worry about.
Furthermore, the measurement tells
us the value $s$ (the `error syndrome') from which we can deduce which 
$M_s$ we have! Armed with this knowledge, we apply $M_s^{-1}$
to $qc$ by means of a few quantum gates ($X$, $Z$ or $Y$), thus
producing the final state $\ket{e_s} \ket{\phi_E} \ket{s}_a$. In other
words, we have recovered the noise-free state of $qc$! The
final environment state is immaterial, and we can re-prepare the
ancilla in $\ket{0}_a$ for further use. 

The only assumption in the above was that the noise in eq. (\ref{noise}) only 
contains error operators in the correctable set $\cal S$. In practice, the 
noise includes both members and non-members of $\cal S$, and the important 
quantity is the probability that the state collapses onto a correctable one 
when the syndrome is extracted. It is here that the theory of 
error-correcting codes enters in: our task is to find encoding and extraction 
operations $E, A$ such that the set $\cal S$ of correctable errors includes 
all the errors most likely to occur. This is a very difficult problem. 

It is a general truth that to permit efficient
stabilization against noise, we have to know something about the noise we 
wish to suppress. The most obvious quasi-realistic assumption is that of 
uncorrelated stochastic noise. That is, at a given time or place the noise 
might have any effect, but the effects on different qubits, or on the same 
qubit at different times, are uncorrelated. This is the quantum equivalent 
of the binary symetric channel, section \ref{s:bin}. 
By assuming uncorrelated stochastic noise we can place all possible error
operators $M$ in a heirarchy of probability: those affecting few qubits
(i.e. only a few terms in the tensor product are different from $I$)
are most likely, while those affecting many qubits at once are
unlikely. Our aim will be to find quantum error correcting codes
(QECCs) such that all errors affecting up to $t$ qubits will be 
correctable. Such a QECC is termed a `$t$-error correcting code'.

The simplest code construction (that discovered by Calderbank and Shor and 
Steane) goes as follows. First we notice that a classical error correcting 
code, such as the Hamming code shown in table 1, can be used to correct 
$X$ errors. The proof relies on eq. (\ref{syn}) which permits the
syndrome extraction $A$ to produce an ancilla state $\ket{s}$ which
depends only on the error $M_s$ and not on the computer's
state $\ket{\phi}$.
This suggests that we store $k$ quantum bits by means of the 
$2^k$ mutually orthogonal $n$-qubit states $\ket{i}$, where the binary 
number $i$ is a member of a classical error correcting code $C$, see 
section \ref{s:ecc}. This will not allow correction of $Z$ errors, however.
Observe that since $Z = HXH$, the correction 
of $Z$ errors is equivalent to rotating the state of each qubit by $H$, 
correcting $X$ errors, and rotating back again. This rotation is called a 
Hadamard transform; it is just a change in basis. The next ingredient is
to notice the following special property (Steane 1996a):
  \beq
\tilde{H} \sum_{i \in C} \ket{i} = 
\frac{1}{\sqrt{2^k}} \sum_{j \in C^{\perp} } \ket{j}  \lab{CC}
  \eeq
where $\tilde{H} \equiv H_1 H_2 H_3 \cdots H_n$.
In words, this says that if we make a quantum state by
superposing all the members of a classical error correcting code $C$, then
the Hadamard-transformed state is just a superposition of all the members
of the dual code $C^{\perp}$. From this it follows, after some 
further steps, that it is possible to correct
both $X$ and $Z$ errors (and therefore also $Y$ errors) if we use
quantum states of the form given in eq. (\ref{CC}), as long as both
$C$ and $C^{\perp}$ are good classical error correcting codes,
i.e. both have good correction abilities.

The simplest QECC constructed by the above recipe requires $n=7$
qubits to store a single ($k=1$) qubit of useful quantum information.
The two orthogonal states required to store the information are built
from the Hamming code shown in table 1:
  \begin{eqnarray}
\ket{0_E} \!\!\!\! &\equiv& \!\!\!\! 
  \ket{0000000} + \ket{1010101} + \ket{0110011} + \ket{1100110}
\nonumber \\
          && \rule{-9ex}{0em}
+ \ket{0001111} + \ket{1011010} + \ket{0111100} + \ket{1101001} 
\label{0E} \\
\ket{1_E} \!\!\!\! &\equiv& \!\!\!\!
  \ket{1111111} + \ket{0101010} + \ket{1001100} + \ket{0011001}
\nonumber \\
          && \rule{-9ex}{0em}
+ \ket{1110000} + \ket{0100101} + \ket{1000011} + \ket{0010110}
\label{1E}
  \end{eqnarray}
Such a QECC has the following remarkable property. Imagine I store a general 
(unknown) state of a single qubit into a spin state $a\ket{0_E} + b 
\ket{1_E}$ of 7 spin-half particles. I then allow you to do anything at all 
to any one of the 7 spins. I could nevertheless extract my original qubit 
state {\em exactly}. Therefore the large perturbation you introduced
did nothing at all to the stored quantum information!

More powerful QECCs can be obtained from more powerful classical codes, and 
there exist quantum code constructions more efficient than the one 
just outlined. Suppose we store $k$ qubits into $n$. There are $3n$ ways for a 
single qubit to be in error, since the error might be one of $X$, $Y$ or $Z$. 
The number of syndrome bits is $n-k$, so if every single-qubit error,
and the error-free case, is to have 
a different syndrome, we require $2^{n-k} \ge 3n + 1$. For $k=1$ this lower 
limit is filled exactly by $n=5$ and indeed such a 5-qubit
single-error correcting code exists (Laflamme {\em et. al.} 1996,
Bennett {\em et. al.} 1996b).

More generally,
the remarkable fact is that for fixed $k/n$, codes exist for which $t/n$ is 
bounded from below as $n \rightarrow \infty$ (Calderbank and Shor 1995, 
Steane 1996b, Calderbank {\em et. al.} 1997). This leads to a quantum 
version of Shannon's theorem (section \ref{s:ecc}), though an exact 
definition of the capacity of a quantum channel remains unclear (Schumacher 
and Nielsen 1996, Barnum {\em et. al.} 1996,
Lloyd 1997, Bennett {\em et. al.} 1996b, Knill and 
Laflamme 1997a). For finite $n$, the probability that the noise produces 
uncorrectable errors scales roughly as $(n \epsilon)^{t+1}$, where 
$\epsilon \ll 1$ is the probability of an arbitrary error on each qubit. 
This represents an extremely powerful noise suppression. We need to be able 
to reduce $\epsilon$ to a sufficiently small value by passive means, and 
then QEC does the rest. For example, consider the case $\epsilon \simeq 
0.001$. With $n=23$ there exisits a code correcting all $t=3$-qubit errors 
(Golay 1949, Steane 1996c). The probability that uncorrectable noise occurs 
is $\sim 0.023^4 \simeq 3 \times 10^{-7}$, thus the noise is suppressed by 
more than three orders of magnitude. 

So far I have described QEC as if the ancilla and the many quantum gates 
and measurements involved were themselves noise-free. Obviously we must 
drop this assumption if we want to form a realistic impression of what 
might be possible in quantum computing. Shor (1996) and Kitaev (1996) 
discovered ways in which all the required operations can be arranged so 
that the correction suppresses more noise than it introduces. 
The essential ideas are to verify states wherever possible, to restrict the 
propagation of errors by careful network design, and to repeat the syndrome 
extraction: for each group of qubits $qc$, the syndrome is extracted several 
times and $qc$ is only corrected once $t+1$ mutually consistent syndromes are 
obtained. Fig. 14 illustrates a fault-tolerant syndrome 
extraction network, i.e. one which restricts the propagation of errors. Note 
that $a$ is verified before it is used, and each qubit in $qc$ only interacts 
with one qubit in $a$. 

In fault-tolerant computing, we cannot apply arbitrary rotations
of a logical qubit, eq. (\ref{V}), in a single step. However, particular
rotations through irrational angles can be carried out, and thus
general rotations are generated to an arbitrary degree of precision
through repetition. Note that the set of computational
gates is now discrete rather than continuous.

Recently the requirements for reliable quantum computing using fault-tolerant 
QEC have been estimated (Preskill 1997, Steane 1997c). They are formidable. 
For example, a computation beyond the capabilities of the best classical 
computers might require $1000$ qubits and $10^{10}$ quantum gates. Without 
QEC, this would require a noise level of order $10^{-13}$ per qubit per gate, 
which we can rule out as impossible. With QEC, the computer would have to be 
made ten or perhaps one hundred times larger, and many thousands of gates 
would be involved in the correctors for each elementary step in the 
computation. However, much more noise could be tolerated: up to about 
$10^{-5}$ per qubit per gate (i.e. in any of the gates, including those in 
the correctors) (Steane 1997c). This is daunting but possible. 

The error correction methods briefly described here are not the only type 
possible. If we know more about the noise, then humbler methods requiring 
just a few qubits can be quite powerful. Such a method was proposed by 
Cirac {\em et. al.} (1996) to deal with the principle noise source in an 
ion trap, which is changes of the motional state during gate operations. 
Also, some joint states of several qubits can have reduced noise if the 
environment affects all qubits together. For example the two states 
$\ket{01} \pm \ket{10}$ are unchanged by environmental coupling of the form 
$\ket{e_0} I_1 I_2 + \ket{e_1} X_1 X_2$. (Palma {\em et. al.} 1996, Chuang 
and Yamamoto 1997). Such states offer a calm eye within the storm of 
decoherence, in which quantum information can be manipulated with relative 
impunity. A practical computer would probably use a combination of methods. 

\section{Discussion}

The idea of `Quantum Computing' has fired many imaginations simply because 
the words themselves suggest something strange but powerful, as if the 
physicists have come up with a second revolution in information processing 
to herald the next millenium. This is a false impression. Quantum 
computing will not replace classical computing for similar reasons that 
quantum physics does not replace classical physics: no one ever consulted 
Heisenberg in order to design a house, and no one takes their car to be 
mended by a quantum mechanic. If large quantum computers are ever made, 
they will be used to address just those special tasks 
which benefit from quantum information processing. 

A more lasting reason to be excited about quantum computing is that it is 
a new and insightful way to think about the fundamental laws of physics. 
The quantum computing community remains fairly small at present, yet the 
pace of progress has been fast and accelerating in the last few years. The 
ideas of classical information theory seem to fit into quantum mechanics 
like a hand into a glove, giving us the feeling that we are uncovering 
something profound about Nature. Shannon's noiseless coding theorem
leads to Schumacher and Josza's quantum coding theorem and
the significance of the qubit as a useful measure of information. This 
enables us to keep track of quantum information, and to be confident
that it is independent of the details of the system in which it is
stored. This is necessary to underpin other concepts such as error correction
and computing. The classical theory of error correction leads to the 
discovery of quantum error correction. This allows a physical process 
previously thought to be impossible, namely the almost perfect recovery of 
a general quantum state, undoing even irreversible processes such as 
relaxation by spontaneous emission. For example, during a long 
error-corrected quantum computation, using fault-tolerant methods,
every qubit in the computer
might decay a million times and yet the coherence of the quantum
information be preserved.

Hilbert's questions regarding the logical structure of 
mathematics encourage us to ask a new type of question about the laws of 
physics. In looking at Schr\"odinger's equation, we can 
neglect whether it is describing an electron or a planet, and just ask 
about the state manipulations it permits. The language of information and 
computer science enables us to frame such questions. Even such a simple 
idea as the quantum gate, the cousin of the classical binary logic gate, 
turns out to be very useful, because it enables us to think clearly about 
quantum state manipulations which would otherwise seem extremely 
complicated or impractical. Such ideas open the way to the design of
quantum algorithms such as those of Shor, Grover and Kitaev. These
show that quantum mechanics allows information processing of a 
kind ruled out in classical physics. It relies on the propagation of a 
quantum state through a huge (exponentially large) number of dimensions of 
Hilbert space. The computation result arises from a controlled 
interference among many computational paths, which even after we have 
examined the mathematical description, still seems wonderful and 
surprising.

The intrinsic difficulty of quantum computation lies in the sensitivity of 
large-scale interference to noise and imprecision. A point often raised 
against the quantum computer is that it is essentially an analogue rather 
than a digital device, and has many limitations as a result. This is 
a misconception. It is true that any quantum system has a continuous state 
space, but so has any classical system, including the circuits of a digital 
computer. The fault-tolerant methods used to permit error correction in a 
quantum computer restrict the set of quantum gates to a discrete set, 
therefore the `legal' states of the quantum computer are discrete, just as in 
a classical digital computer. The really important difference between 
analogue and digital computing is that to increase the precision of a result 
arrived at by analogue means, one must re-engineer the whole computer, 
whereas with digital methods one need merely increase the number of bits and 
operations. The fault-tolerant quantum computer has more in common with a 
digital than an analogue device. 

Shor's algorithm for the factorisation problem stimulated a lot of 
interest in part because of the connection with data encryption. However, 
I feel that the significance of Shor's algorithm is not primarily in its 
possible use for factoring large integers in the distant future. Rather, 
it has acted as a stimulus to the field, proving the existence of a 
powerful new type of computing made possible by controlled quantum 
evolution, and exhibiting some of the new methods. At present, the most 
practically significant achievement in the general area of quantum 
information physics is not in computing at all, but in quantum key 
distribution.

The title `quantum computer' will remain a misnomer for any experimental 
device realised in the next twenty years. It is an abuse of language to call 
even a pocket calculator a `computer', because the word has come to be 
reserved for general-purpose machines which more or less realise Turing's 
concept of the Universal Machine. The same ought to be true for quantum 
computers if we do not want to mislead people. However, small quantum 
information processors may serve useful roles. For example, concepts learned 
from quantum information theory may permit the discovery of useful new 
spectroscopic methods in nuclear magnetic resonance. Quantum key 
distribution could be made more secure, and made possible over larger 
distances, if small `relay stations' could be built which applied 
purification or error correction methods. The relay station could be an ion 
trap combined with a high-$Q$ cavity, which is realisable with current 
technology. It will surely not be long before a quantum state is 
teleported from one laboratory to another, a very exciting prospect. 

The great intrinsic value of a large quantum computer is offset by the 
difficulty of making one. However, few would argue that this prize
does not at least merit a lot of effort to find out just
how unattainable, or hopefully attainable, it is. One of the 
chief uses of a processor which could manipulate a few quantum bits may be to 
help us better understand decoherence in quantum mechanics. This will 
be amenable to experimental investigation during the next few years: rather
than waiting in hope, there is useful work to be done now. 

On the theoretical side, there are two major open questions: the nature of 
quantum algorithms, and the limits on reliability of quantum computing. It 
is not yet clear what is the essential nature of quantum computing, and 
what general class of computational problem is amenable to efficient 
solution by quantum methods. Is there a whole mine of useful quantum 
algorithms waiting to be delved, or will the supply dry up with the few 
nuggets we have so far discovered? Can significant computational
power be achieved with less than 100 qubits? This is by no means
ruled out, since it is hard to simulate even 20 qubits by classical
means. Concerning reliability, great progress 
has been made, so that we can now be cautiously optimistic that quantum 
computing is not an impossible dream. We can identify requirements {\em 
sufficient} to guarantee reliable computing, involving for example 
uncorrelated stochastic noise of order $10^{-5}$ per gate, and a quantum 
computer a hundred times larger than the logical machine embedded within 
it. However, can quantum decoherence be relied upon to have the properties 
assumed in such an estimate, and if not then can error correction methods 
still be found? Conversely, once we know more about the noise,
it may be possible to identify considerably less taxing requirements
for reliable computing.

To conclude with, I would like to propose a more wide-ranging 
theoretical task: to arrive at a set of principles like energy and momentum 
conservation, but which apply to information, and from which much
of quantum mechanics could be derived. Two tests of such
ideas would be whether the EPR-Bell correlations thus became transparent,
and whether they rendered obvious the proper use of terms
such as `measurement' and `knowledge'.

I hope that quantum information physics will be recognised as a valuable 
part of fundamental physics. 
The quest to bring together Turing machines, information, number theory and 
quantum physics is for me, and I hope will be for readers of this review, one 
of the most fascinating cultural endeavours one could have the good fortune 
to encounter. 

I thank the Royal Society and St Edmund Hall, Oxford, for their
support.







