Modeling noise and error correction for Majorana-based quantum computing

Majorana-based quantum computing seeks to use the non-local nature of Majorana zero modes to store and manipulate quantum information in a topologically protected way. While noise is anticipated to be significantly suppressed in such systems, finite temperature and system size result in residual errors. In this work, we connect the underlying physical error processes in Majorana-based systems to the noise models used in a fault tolerance analysis. Standard qubit-based noise models built from Pauli operators do not capture leading order noise processes arising from quasiparticle poisoning events, thus it is not obvious {\it a priori} that such noise models can be usefully applied to a Majorana-based system. We develop stochastic Majorana noise models that are generalizations of the standard qubit-based models and connect the error probabilities defining these models to parameters of the physical system. Using these models, we compute pseudo-thresholds for the $d=5$ Bacon-Shor subsystem code. Our results emphasize the importance of correlated errors induced in multi-qubit measurements. Moreover, we find that for sufficiently fast quasiparticle relaxation the errors are well described by Pauli operators. This work bridges the divide between physical errors in Majorana-based quantum computing architectures and the significance of these errors in a quantum error correcting code.


Introduction
Topological phases of matter provide an attractive platform for quantum computation due to the possibility of manipulating information stored in the non-local degenerate state space of non-Abelian anyons. This gives rise to the idea of topological quantum computation [1,2]. Any local probe of the system does not provide information about the qubit state; this topological protection of the encoded informa-tion is anticipated to suppress decoherence from the environment, thereby leading to exceptionally long qubit lifetimes. At present, the most promising approach for topological quantum computing uses the non-Abelian properties of Majorana zero modes (MZMs) that can be localized at the ends of topological superconducting wires [3][4][5][6][7][8][9][10][11][12][13][14] 1 .
Each MZM is described by a Hermitian operator, γ a = γ † a , which obeys fermionic anticommutation relations {γ a , γ b } = 2δ a,b . A pair of MZMs corresponds to a single fermionic state with occupation number c † c = (1 + iγ a γ b ) /2, where c = (γ a + iγ b ) /2 is a Dirac fermion operator. Quantum information can be encoded through the occupation of the fermionic state that can be unoccupied (even parity) or occupied (odd parity). Application of one of the Majorana operators to the state flips the fermion parity. When using a modular approach where each qubit is encoded in a separate superconducting island, at least four MZMs are required to store a qubit [15]. If the total fermion parity of the superconducting island is fixed to be even, then the qubit states correspond to both pairs of MZMs having even parity or both pairs having odd parity. It is a choice of basis how to pair the MZMs (e.g., pairing γ 1 with γ 2 and γ 3 with γ 4 as opposed to γ 1 with γ 3 and γ 2 with γ 4 ); which means that unlike other qubit schemes, phase errors and bit-flip errors result from the same physical processes. That is, for one encoding choice, the operator γ 1 γ 3 flips the qubit state, while for the other, it results in a phase error. Physically, errors described by Majorana operators are due to, for instance, thermally excited quasiparticles, finite hybridization of MZMs, or external quasiparticle poisoning of the island. In the absence of non-equilibrium noise sources, these errors will generally be exponentially suppressed in ratios involving the physical parameters of the system that are expected to be large, but cannot be made arbitrarily small for practical reasons [16][17][18][19][20][21][22][23].
The small error rates discussed above set an upper bound on the qubit lifetime. In order to store information for a longer time, it is necessary to perform quantum error correction on the system. For a given quantum error correcting code, if the error rate is below a particular value, known as the code's pseudo-threshold, the qubit's lifetime is increased. Studying the effectiveness of quantum error correcting codes for Majorana-based systems is a relatively recent and important development in the field of topological quantum computation [15,[24][25][26][27][28][29][30][31][32][33][34][35][36]. Thus far, the majority of studies (with the exceptions of Refs. [24,26,34,35]) have assumed qubitbased noise models, which approximate noise in the system by Pauli errors and measurement bit-flips. For a MZM system, errors are naturally modeled by products of Majorana operators. Some of the most important types of errors (e.g., quasiparticle poisoning [16][17][18]) involve an odd number of Majorana operators, which take the system out of the computational subspace and are therefore not described by Pauli operators. Thus, unless the effect of these errors can be captured with measurement bit-flips, the noise affecting a MZM system is outside the scope of a qubit-based noise model. The purpose of this paper is to connect the underlying physical error processes in a Majorana-based quantum computing architecture to a noise model that can be used to analyze fault tolerance of the system. To this end, we develop stochastic Majorana noise models from physical considerations of proposed MZM systems and discuss the parameters that control the probabilities of applying different products of Majorana operators and the probability of measurement bit-flips. These noise models reduce to qubit-based noise models when the probabilities of an odd number of Majorana operators being applied is set to zero. By analyzing these noise models for a small Bacon-Shor subsystem code [37][38][39], we find that correlated errors induced through multiqubit measurements are most problematic for fault tolerance, and therefore, would be most important to minimize in a Majorana-based quantum computing architecture. We find that for charging-energy-protected MZM qubits [40,41], the pseudo-threshold values calculated with a Majorana noise model are well approximated by a qubit-based noise model for finite, but sufficiently small, odd-Majorana error probabilities. More generally, our work provides and exemplifies a framework for analyzing Majorana-based error correction that can be extended to other physical MZM architectures.

Guide to the Reader
The remainder of this paper is organized as follows. In Section 2, we present four stochastic Majorana noise models in order of simplest to most realistic. We define exactly what is meant by a stochastic Majorana noise model and justify why stochastic noise is an appropriate approximation of the errors occurring in a Majorana-based system. We further discuss in what limit our models reduce to analogous qubit-based noise models. In Section 3, we use physical considerations to mo-tivate the errors included in the noise models. We focus on a particular Majorana-based qubit proposal [41] and estimate the dependence of error rates on physical parameters in this system. A summary of how these physical considerations relate to the parameters of the noise models is given in Table 2. In Section 4, we apply the Bacon-Shor subsystem code to our noise models to estimate pseudo-thresholds and the relative importance of the different error processes from an error correction viewpoint. One motivation for using the Bacon-Shor subsystem code is that it can be implemented using only two-qubit measurements, which we anticipate to be easier to perform experimentally on a MZM system than the higher-weight measurements required for more standard error-correcting codes (e.g., the surface code) 2 . We discuss experimental implications of our analysis at the end of this section. In Section 5, we discuss extensions of our analysis to other MZM qubit proposals and error correcting codes. Finally, in Section 6, we conclude and identify future directions. Details of the various discussions are relegated to the appendices.
This paper is intended for both a condensed matter and a fault tolerance audience; as such it contains review material that readers from either community may find superfluous. Readers from a fault tolerance background may wish to skip Sections 2.1, 4.1, and 4.2. For those already familiar with topological superconductivity, Sections 3.1 and 3.2 may be skimmed. Additionally, those not interested in the technical aspects of fault tolerance might wish to skim Sections 4.1 and 4.3, while those who are not invested in the physical noise processes affecting a MZM system should skim Sections 3.1 and 3.2. The main results of this paper are contained in Sections 2.2 and 4.4.

Stochastic Majorana Noise Models
In this section, we develop stochastic Majorana noise models analogous to the standard qubit-based noise models. There are several motivations for tailoring a noise model to a system of MZMs. (1) In general, the physical sources of errors are best understood in terms of interactions of the environment with the MZMs; a Majorana noise model is therefore more transparently connected to the physical system, affords a more precise description of the noise that can lead to more realistic quantum error correction simulations, and can be applied independently of the encoding of quantum information. (2) Majorana-based quantum computing architectures do not necessarily group MZMs into qubits; as such, noise models that describe environmental effects as qubit errors are not applicable to all MZM systems. For instance, a Majorana fermion code [24,34,35] could not be fully analyzed with a qubit noise model. (3) Even when MZMs are arranged into qubits, some of the most common types of errors take the system out of the computational subspace (e.g., quasiparticle poisoning [16][17][18]), and are therefore not captured by the probabilistic application of Pauli errors.
Throughout this paper, we consider a set of 2n Majorana zero modes (MZMs), with corresponding operators γ 1 , γ 2 , . . . γ 2n . Noise models discretize time into time steps. In a stochastic Majorana noise model, after a time step τ , a probabilistically generated string of Majorana operators, γ a1 1 . . . γ a2n 2n , for a ∈ {0, 1} 2n , is applied to the state ρ M of the MZM subsystem. Additionally, the noise models allow for measurement errors that modify the binary vector m = (m 1 , . . . , m N ) of the time step's N measurement outcomes by bitwise addition of the probabilistically generated vector b = (b 1 , . . . , b N ), for m, b ∈ {0, 1} N . The noise model only tracks operators applied to either the MZM subsystem or the measurement outcomes. Considering operators acting on the full system (i.e., MZM subsystem and its environment) enables us to identify which operators to include in the noise model. More explicitly, when the full system (MZMs plus environment) begins in a product state ρ M ⊗ |e 0 e 0 |, the timeevolved projected density matrix can be written as [42] where U denotes the unitary evolution and ε j ≡ e j |U |e 0 is the projection of the environmental noise processes onto the MZM subsystem. The operator ε j is therefore some combination of Majorana operators: Instead of considering the density matrix ρ M , Eq. (1) can equivalently be seen as a quantum trajectory where during the time step the pure state |ψ M transforms as with some probability P j . Noise described by Eq. (3) depends on the 2 n coefficients o l a1...a2n , which renders numerical simulations of large systems intractable.
Fortunately, Eq. (3) can be greatly simplified by noting that decoherence processes such as energy relaxation and phonons will destroy the coherence between different products of Majorana operators. In other words, local noise processes do not result in superpositions of products of Majorana operators (as opposed to non-local operations on the computational state that allow coherent superpositions of Majorana operators to be maintained over long time periods). Moreover, error correction itself separates many of the linear combinations in Eq. (3) [42]. Given these considerations, we can replace the intractable model of Eq. (3) with a simpler, stochastic Majorana noise model. Then each time step gives: with some probability Pr( a, b). The order of Majorana operators in Eq. (4) is unimportant as it only contributes to the overall phase of the error operator. The noise described by Eq. (4) is unitary, and thus does not include an amplitude damping channel or an erasure channel. This is not necessarily a crucial limitation since a pessimistic estimate can be obtained by sufficiently strong noise that randomly flips the qubits. This is the standard approach for the qubit-based noise models reviewed in the next section. As a consequence, however, the latter fails to take into account the relaxation time T 1 characterizing the timescale during which the system relaxes to the lowerenergy qubit state. In a MZM system, there is no such time scale, since in practice the temperature is larger than the degeneracy splitting of the qubit states. Thus, the assumption that noise has unit amplitude provides a more accurate description of the physical noise processes for Majorana-based qubits.
The content of different stochastic models is contained entirely in the probability distribution {Pr( a, b)}. Given this distribution, the errors in the system propagate classically and can be efficiently simulated using standard Monte Carlo techniques by tracking the net Majorana operators applied at any given time. For this reason, when a model of the type given in Eqs. (4) and (5) mimics the actual noise in a physical system, it is extremely useful for studying quantum error correction.
In the following, a noise event refers to the application of one of the operations of the right hand side of Eqs. (4) or (5). For simplicity of relating the probabilities defining our noise models to physical processes, we include noise events that apply the same Majorana operator twice (therefore not causing an error). The following presentation of the noise models is tailored for conceptual ease; in Section 4 and Appendix C we give a more explicit description of how one can simulate these noise models.

Qubit-based stochastic noise models
We first review three well-known qubit-based stochastic noise models, all of which are built from Pauli operators and measurement bit-flips. In each case, we consider a scenario consisting of a sequence of time steps, where a set of single-and multi-qubit measurements and/or gates are applied in each step.
Throughout the paper, the error probabilities of the Pauli noise models are slightly reweighted compared to their standard presentation by also including the identity operator as a possible error. This allows for an easier comparison with Majorana noise models where noise events can lead to the application of γ 2 a = 1.
Pauli noise (or code capacity noise). For a given time step and for each qubit: 1. Apply one single-qubit operator (either 1, X, Y , or Z, chosen uniformly) with probability p; otherwise do nothing.
2. Apply all measurement projectors perfectly.
More explicitly, Pauli operators X, Y , or Z are applied with probability p/4 and identity is applied with probability 1 − 3p/4. As noted above, the non-standard normalization is chosen for ease of comparison with the Majorana noise models introduced in the following section. For the remaining noise models, we will not explicitly write "otherwise do nothing." Pauli noise is defined by the single parameter p. While the model is too simple to provide realistic estimates of an error-correcting code's performance, it serves as a quick first test of any code.
Pauli noise with bit-flip measurement (or phenomenological noise). For a given time step, for each qubit apply step 1 of Pauli noise, then: 2. Apply all measurement projectors perfectly, then flip each measurement outcome with probability p mst .
Note that flipping the measurement outcome does not change the state of the system, only our information about the system.
Pauli noise with bit-flip measurement is defined by two parameters, {p, p mst }, which may be taken to be equal, p = p mst , for a simple estimate of a code's pseudo-threshold. We emphasize that the measurement projections are still applied exactly, but the classical bit which stores the measurement outcome can be flipped. This model is motivated on the grounds that qualitatively different error correction approaches are required to handle faulty measurements in addition to errors on the encoded information alone, making this minimal addition to Pauli noise useful for discriminating between codes.
Pauli circuit noise (or circuit-level noise) extends the previous two models to account for the different noise processes affecting a qubit during an operation (unitary gate or measurement). For a given time step, each qubit is involved in a k-qubit operation, where k = 0 for an idle qubit. For all sets of qubits involved in the same k-qubit operation: 1. Do the following: (a) For each qubit in the set, apply one single-qubit operator (either 1, X, Y , or Z, chosen uniformly) with probability p (k) .
(b) Apply a k-qubit Pauli operator with probability p (k) cor . For k = 2, this is any element of the set of 16 operators 2. Apply the measurement projector perfectly, then flip the k-qubit measurement outcome with probability p (k) mst . For an idle qubit, do nothing.
For step 1a, X, Y , or Z are applied with probability p (k) /4 and identity is applied with probability 1 − 3p (k) /4. For step 1b, any given non-trivial Pauli operator is applied with probability p (k) cor /16 and identity is applied with probabil- cor /16. Again, the non-standard normalization is chosen to simplify comparison with the Majorana noise models in the following section.
Pauli circuit noise is defined by the set of probabilities It is for this noise model (slightly renormalized 3 ) with the probability of a single-qubit, two-qubit, and measurement bit-flip error equally likely, that the well-known result is found that the qubit surface code has an error threshold value of p th ≈ 1% [43,44]. This means that a quantum state can be reliably stored in an (arbitrarily large) surface code for an indefinite period of time for qubits subjected to circuit-level noise with p < p th .

Stochastic Majorana noise models
We now present four stochastic Majorana noise models in order of increasing complexity. The first three are analogous to the qubit-based models reviewed above. The fourth is motivated by a particular physical implementation and measurement protocol of a Majorana-based quantum computing architecture [40,41].
Naively, the simplest stochastic Majorana noise model to consider would simply apply the Majorana operator γ i with probability p for each i ∈ {1, 2, . . . , 2n} in each time step, followed by perfect measurements. However, such a model would on average spend an equal amount of time in an even total MZM parity state as in an odd total MZM parity state. In the case of superconducting islands with charging energy, e.g., for the system described in Section 3.1, the energy separation of these states is large (on the order of the superconducting gap or the charging energy of the island) and thus physically we would expect the system to spend much 3 Note that because of the renormalization of probabilities to include the identity operation, this result is found for p = p (k) mst = 3/4p (0) = 3/4p (1) = 15/16p (2) cor .
Accepted in Quantum 2018-08-21, click title to verify MZM measurement islands Figure 1: Schematic of a quantum computing architecture with 2n MZMs (red stars) equally divided among n/m islands (blue boxes). The inset zooms in on the jth island. As an example, we indicate a two-MZM measurement and the possible noise events for the Majorana noise model QpBf when the island begins a time step in the even parity state. more time in the lower-energy state corresponding to a specific MZM parity. To more accurately describe this situation, we go beyond the naive model and introduce the concept of MZM islands.
We assume that the MZMs are naturally split into n/m subsets, each of which contains 2m MZMs belonging to the same superconducting island (see Fig. 1). We assume that the initial 2m-MZM parity on each island is even so that, for a given time step, an island has even parity if an even number of Majorana operators have been applied in its history, and has odd parity otherwise. By keeping track of the parity of the islands, the probability of applying an odd number of Majorana operators can be adjusted depending on whether this would relax the system back to the ground state or lead to an excited state. This is captured by an additional step 0 in Majorana noise models that is not required for the qubit ones.
Each noise model contains up to four types of noise events: • Quasiparticle event: application of a single Majorana operator: |ψ M → γ j,a |ψ M .
• Pair-wise dephasing event: application of a pair of Majorana operators belonging to the same island: • Correlated event: application of Majorana operators from multiple islands involved in the same measurement (see later discussion or Table 1 for examples).
The naming of the noise events will become clear in Section 3 when we describe the physical processes contributing to each error-type. To simplify combinatorial prefactors, we allow the same Majorana operator to be used multiple times in a given noise event (e.g., pair-wise dephasing includes the identity operator γ 2 a ). We also keep track of ordering, so that applying the pairs γ a γ b and γ b γ a are considered different noise events (multiple noise events contribute to the same type of error). Unless otherwise noted, we assume that the Majorana operators corresponding to a given noise event are chosen uniformly over all MZMs on the island.
We note that even if subsets of MZMs are combined into physical qubits, errors involving an odd number of Majorana operators on any given island cannot be described by Pauli operators, motivating the consideration of stochastic Majorana noise models.
Quasiparticle noise (Qp). In a given time step, implement the following sequence for each island: 0. If the island begins the time step with odd parity, apply a quasiparticle event with probability p odd .
1. Apply one single-island noise event: either a quasiparticle event with probability p qp or a pair-wise dephasing event with probability p pair .
2. Apply all measurement projectors perfectly.
We count 2m × 2m different pairs of Majorana operators per island. In step 1, the operator γ j,a is applied with probability p qp /2m, the operator γ j,a γ j,b (a = b) is applied with probability p pair /(2m) 2 , and identity is applied with probability 1 − p qp − 3p pair /4 (because of pair-wise dephasing events with γ 2 j,a = 1). The set of probabilities {p odd , p qp , p pair } defines this model. In an encoding where four MZMs define a physical qubit, Qp reduces to the qubit-based model Pauli noise when p qp = 0 (with p → p pair ).
As mentioned above, step 0 accounts for the energy difference between an island with odd parity and even parity: when p qp p odd , each island in the system spends on average very little time in the odd MZM parity state. We will return to this discussion in Section 3.1.  4 pcor,even/Neven p (2) cor,even /(16m 2 ) and their corresponding probabilities are schematically depicted in Fig. 1 and listed in Table 1 for an island beginning a time step in the even parity state.

Quasiparticle noise and bit-flip measurement
Correlated events. Models Qp and QpBf do not distinguish the probabilities of noise events involving MZMs on idle islands from those on measured islands. We would now like to account for these differences. Define γ j,a to be the operator corresponding to the ath MZM on the jth island. We consider two types of correlated events possible in a multiple-island measurement: • Odd correlated event: application of a string of three or more Majorana operators involving at least two islands, such that an odd number (up to m − 1) of Majorana operators are applied to one of the islands involved in a k-island measurement. There is an even number (up to m) of Majorana operators applied to the remaining k − 1 islands involved in the measurement. For example, an odd correlated event in a two-island measurement of islands i and j results in • Even correlated event: application of a string of four or more Majorana operators involving at least two islands, such that an even number (up to m) of Majorana operators are applied to all the islands involved in the kisland measurement. For example, an even correlated event in a two-island measurement of islands i and j results in In the following, we assume that during a time step each island is either idle or involved in a single measurement. The spread of correlated events can be mitigated by restricting the number of islands involved in a measurement. For instance, for the Bacon-Shor code studied in Section 4, correlated events only involve nearest neighbor islands.
Majorana circuit noise (MC). In a given time step, for a set of islands involved in the same k-island measurement (k = 0 for an idle island), implement the following sequence: 0. For each island that begins the time step with odd parity, apply a quasiparticle event with probability p   where k max is the maximum number of islands involved in a measurement. MC has the same action on an idle island (k = 0) as Qp, with the probability set {p odd , p qp , p pair } → {p pair }. MC has the same action on an island involved in a single-island measurement (k = 1) as QpBf, with the probability set {p odd , p qp , p pair , p mst } → {p (1) odd , p (1) qp , p (1) pair , p (1) mst }. In an encoding where four MZMs define a physical qubit and if the probability of any error involving an odd number of Majorana operators on a given island is set to zero (i.e., p cor,odd = 0), MC reduces to the qubit-based model Pauli circuit noise, with the probabilities related by {p (k) , p (2) cor , p pair , p (2) cor,even , p In Table 1, we compare the probabilities of noise events in step 1 of models Qp, QpBf, and MC. We see that MC allows for the possibility that noise events affecting multiple islands connected by a measurement happen with greater probability than independent noise events on the islands (e.g., when p (2) cor,even > p 2 pair ).
Physical Majorana circuit noise (PMC). This model refines MC by considering a specific physical implementation and measurement protocol of the MZM system [40,41]. Focusing on a specific measurement protocol allows us to drop many of the correlated events included in MC, as well as to separate noise events involving measured MZMs from those only involving unmeasured MZMs. These two modifications enable a more accurate description of this physical system, see Section 3.1 for a description of the underlying causes of errors in such a system. We assume that our measurement protocol allows parity measurements of two MZMs belonging to the same island and joint parity measurements of a set of four MZMs on two islands. During a given time step, each island is now either idle (k = 0), involved in a two-MZM measurement (k = 1), or involved in a four-MZM measurement (k = 2).
The model follows the same steps as MC, with slight modifications of steps 0 and 1(a) for islands that are involved in a measurement, to account for whether particular MZMs are connected to the measurement apparatus or not: 0. For each island that begins the time step with odd parity, apply a quasiparticle event corresponding to: • A MZM not involved in the measurement with probability 2m−2 2m p For each island in the set with k ≥ 1, apply either a quasiparticle event corresponding to: or a pair-wise dephasing event corresponding to: • A pair of MZMs not involved in the measurement pair . • A pair of MZMs, with at least one of them involved in the measurement, with probability pair .
Furthermore, we consider a restricted set of correlated events in step 1(b) so that odd correlated events are strings of three Majorana operators γ i,a γ i,b γ j,b and even correlated events are strings of four Majorana operators γ i,a γ i,b γ j,b γ j,c , such that i = j and the indices are chosen such that γ i,b and γ j,b are involved in a measurement. PMC is defined by the same set of probabilities as MC, with k max = 2. While MC treated all MZMs on a given island identically, PMC distinguishes between the measured and unmeasured MZMs within the island for single-qubit noise events. Furthermore, correlated events in PMC always involve a pair of MZMs directly coupled by the measurement. In Table 1, we compare noise event probabilities for all four models. Only a restricted set of correlated events are considered in PMC, which changes the combinatorial prefactors of the probabilities of these events between MC and PMC.

Physical System
In the following, we use a recently proposed implementation of a measurement-based topological quantum computer [41] as an example to illustrate the different types of errors and to connect them to our noise models. The system consists of an array of four-MZM islands, tetrons, depicted in Fig. 2. In this proposal, the MZM islands have a finite charging energy E C . Each tetron corresponds to a physical qubit, whose states are stored in the two nearly-degenerate ground states within a total parity subspace. In the absence of quasiparticle poisoning, the latter is fixed to be either even or odd. The inset of Fig. 2 shows the details of a tetron implementation based on a single superconducting island composed of two topological superconducting wires of length L (gray lines), connected by a conventional superconducting bridge (blue line). There are four MZMs (red stars), localized at the end points of the topological superconductors. Multiple tetrons are connected to each other by semiconducting wires (orange lines), which may be gated (not shown) to allow for  measurement by quantum dots [41]. The Hilbert space of a single tetron contains many of the features applicable to a large class of MZM systems, however the measurement protocol is specific to this qubit proposal.

Spectrum and single MZM excitations
In this section, we identify the types of errors that appear in a Majorana-based quantum computing architecture and discuss how the probabilities of these errors depend on the physical parameters of the system. For ease of explanation, we focus on a particular Majorana-based qubit proposal, reviewed in Section 3.1. In Section 3.2, we discuss the different error processes and corresponding transition rates. In Section 3.3, we connect the parameters of the noise models with a small set of physical parameters that can be expressed in terms of the transition rates. When possible, we distinguish between the features that are generic to systems of MZMs and those that are specific to the example system we consider. The former will motivate the errors included in MC, while the latter will explain the refinement of MC to PMC.

Example system: Tetron array
The jth tetron can be described by the Hamiltonian 4 4 In Eq. (6) we assumed that "mutual charging energy" terms that could couple pairs of MZMs belonging to different tetrons are perfectly quenched. We will comment more these terms in Section 3.2.4. Figure 3: Cartoon of the energy levels of a single tetron against dimensionless gate voltage for EC = 2∆ (left panel) and EC = ∆/2 (right panel), where EC is the charging energy of the island and ∆ is the superconducting gap. For fixed gate volgate −0.5 < ng < 0.5, the system has a nearly-degenerate ground state with an even four-MZM parity. The degeneracy is broken by the MZM hybridization δE ab , leading to distinct states |g |ψi M denoted by solid blue and purple curves. The energy bands bordered by solid orange and red curves correspond to the states |e ∆ |ψi M that have total fermion parity even, and odd four-MZM parity. The shaded regions indicate that the bands contain many discrete energy levels, with level spacing δis. The dashed blue and purple curves correspond to the states |eC,± |ψi M that have total fermion parity odd, and odd four-MZM parity. Comparing the right and left panels near ng ≈ 0, we see that when EC is larger (smaller) than ∆, the quasiparticle-poisoned states with one extra or one fewer electron on the superconducting island, |eC,± |ψi M , are higher (lower) in energy than the lowest energy states with a thermally excited quasiparticle, |e ∆ |ψi M .
where a, b = 1, 2, 3, 4. The last two terms (BCS Hamiltonian and MZM hybridization) are present in all MZM systems, while the first term (charging energy Hamiltonian) is present in systems for which the superconducting island is Coulomb-blockaded (i.e., not grounded).
In the charging energy Hamiltonian, the operatorn s , with integer eigenvalues n s , is the number operator for electrons on the superconducting island. Generally the energy will be minimized when n s is the integer closest to n g , the dimensionless gate voltage applied to the superconducting island. When n g is an integer, adding an electron to or subtracting an electron from the island costs a charging energy E C , which is set by the capacitance of the superconducting island.
The BCS Hamiltonian is written in terms of the quasiparticle number operatorn ∆,k , with integer eigenvalues n ∆,k . More specifically,n ∆,k counts the number of above-gap quasiparticles on the superconducting island with crystal momentum k, occupying the state with energy where ∆ is the superconducting gap and µ is the chemical potential. Due to the finite size of the island, only a dis-crete set of momenta, {k i }, is allowed. The level spacing of the island, δ is , is the separation between adjacent energies: The last term of Eq. (6) describes the MZM hybridization energy, δE ab , between MZMs γ j,a and γ j,b . Generally, δE ab is set by the wavefunction overlap, resulting in a length dependence δE ab ∝ e −L ab /ξ , where L ab is the distance separating γ j,a and γ j,b and ξ is the superconducting coherence length. The topological protection of the system is manifested as an exponentially small ground state degeneracy splitting and requires L ab ξ. We denote the eigenstates of Eq. (6) using the basis |n s , {n ∆,k } ∆ |iγ j,1 γ j,2 , iγ j,3 γ j,4 . The first set of quantum numbers describes the non-topological degrees of freedom: charge or quasiparticle excitations. The second set denotes the (almost) degenerate MZM subspace. The pairing of Majorana operators into iγ j,1 γ j,2 and iγ j,3 γ j,4 is an arbitrary choice. Note that the total fermion parity of the island, 2(n s mod 2) − 1, equals the product of the quasiparticle and four-MZM parity.
To discuss the leading excitations, we compare the energy levels of the system for E C = 2∆ and for E C = ∆/2 in the left and right panels of Fig. 3. Solid curves correspond to an even number of particles n s on the superconducting island, dashed curves to odd n s . The tetron is operated at an even integer value for the dimensionless gate voltage to maximize protection from quasiparticle poisoning by maximizing the energy separation between solid and dashed curves. Without loss of generality we assume n g ≈ 0. In this regime, there are two nearly degenerate ground states: with i = 0, 1 and corresponding energy given by the solid blue and purple curves centered at n g = 0. We write {n ∆,k } ∆ = {0} ∆ to denote that there are no quasiparticles occupying energy levels above the superconducting gap. The qubit is stored in the two MZM states |ψ i M , which are orthogonal linear combinations of the even four-MZM parity basis states |iγ j,1 γ j,2 = ±1, iγ j,3 γ j,4 = ±1 . When the only non-vanishing hybridizations are δE 12 and δE 34 , |ψ i M is simply | ± 1, ±1 . There are two bands of lowest excited states with even n s , that correspond to a single thermally excited quasiparticle. Their energies are shown in Fig. 3 by the overlapping shaded regions bordered by solid orange and red curves. Two-quasiparticle excitations require energies of at least 2∆ and are therefore much less likely; in the following, we restrict our attention to n ∆,k ∈ {0, 1}. We denote a single excitation with energy larger than the gap ∆ as e ∆ . The two bands are denoted by the states with i = 0, 1. In the above, e ∆ may denote different k states; this does not matter for our discussion as long as we focus on states with energy ≈ ∆. Here, the MZM states |ψ i M are orthogonal linear superpositions of the odd four-MZM fermion parity states |iγ j,1 γ j,2 = ±1, iγ j,3 γ j,4 = ∓1 . Depending on whether n g is positive or negative, the two lowest excited states with odd total fermion parity contain either an extra electron or one fewer electron, respectively. Such states are quasiparticle-poisoned. The states with one extra (one fewer) electron are written as with energy levels shown in the dashed blue and purple parabolas centered about n g = ±1.
The state of the MZMs is very similar for the two excited states discussed above. In both cases, an excitation process exchanges an electron between the MZMs and other fermionic modes represented by either the excited quasiparticles or by an external environment. The excitation acts by applying a single Majorana operator to the state |ψ i M . The ground states |g |ψ i M and the excited states |e ∆ |ψ i M , |e C,± |ψ i M are therefore distinguished by their four-MZM parity, with odd parity states separated from the even parity ground states by an energy min (∆, E C ). In our stochastic Majorana noise models, we focus only on these four lowest energy states and can therefore use the four-MZM parity as a measure of whether an island is in a ground or an excited state. In order to include higher excited states, we would need to separately track the four-MZM parity and the quantum numbers n s and {n ∆,k }.

Measurements
For an array of tetrons, parity measurements can be implemented by coupling the MZMs to quantum dots [41] or by a conductance-based readout scheme [15,40]. Most of the measurement concepts can be used interchangeably between the two approaches. In the following, we focus on quantumdot based measurements. The most common examples are measuring the parity of a pair of MZMs on a single island, or measuring a four-MZM parity composed out of two MZMpairs from separate islands. The latter can induce correlated excitations of different islands. Other Majorana-based quantum computing architectures employ different measurement schemes, which in general will change the correlated events between islands being measured. In Section 5, we comment on how the different measurement schemes of other Majorana-based quantum computing architectures affect which types of correlated events the noise model should include.
To measure the parity of a pair of MZMs γ 1,m and γ 1,m belonging to the same tetron, electrostatic gates in the semiconducting wire adjacent to the MZMs are tuned to form a quantum dot tunnel-coupled to γ 1,m and γ 1,m , as shown in the left panel of Fig. 4. To measure the parity of four MZMs (two pairs on two different superconducting islands),  the electrostatic gates are tuned to form two quantum dots, each of which is tunnel-coupled to a MZM on each island, as shown in the right panel of Fig. 4. An isolated quantum dot is described by a chargingenergy Hamiltonian where d is the fermionic annihilation operator for the quantum dot and N g is the dimensionless gate voltage on the dot. Writing the eigenvalues of the number operator for quantum dot levels as N d , the quantum dot Hamiltonian is spanned by the occupation basis |N d d . We assume that the quantum dot is in the spin-polarized regime such that the available states are |0 d , |1 d . When performing a measurement, a tunneling Hamiltonian couples Eqs. (6) and (11). For instance, for the two-MZM measurement, the tunneling term takes the form where t m is the tunneling amplitude between MZM γ 1,m and the quantum dot, and a − is a bosonic operator removing a single electron charge from the island. Equation (12) hybridizes the two quantum dot states |0 d and |1 d in a two-MZM parity-dependent manner. By measuring the energy levels, charge occupation, or quantum capacitance The edges of the triangle denote the quasiparticle event that transitions the system between the given states (thermal excitation of an above-gap quasiparticle or extrinsic quasiparticle poisoning), and are labeled by the corresponding transition rate for that process (in blue) and the operators that act on the system for that given process (in red). Arrows can be reversed by conjugating the operators, but the rates for the opposite processes can be drastically different.
of the quantum dot, one can extract the two-MZM parity iγ 1,m γ 1,m of the system. Such a two-MZM measurement can be used to infer whether the tetron is in computational state |ψ 0 M or |ψ 1 M . For a more-detailed discussion, see Ref. [41].
In the remainder of this section, we make the following gauge choice: all fermion operators are neutral and the charge on the system is accounted for by the bosonic operatorn s . We define the neutral creation operator of an above-gap quasiparticle with crystal momentum k as c † . When an electron enters or leaves the superconducting island, the eigenvalue n s changes by 1. We account for this change with the ladder operators a ± , which raise or lower n s .

Error processes
In this section, we discuss the main physical processes contributing to errors in Majorana-based quantum computing architectures. The corresponding error rates will be independent of which computational (MZM) state the system is in, as such we simplify notation by dropping the MZM labels |ψ M , |ψ M and only writing the energy state |g , |e ∆ , or |e C,± . When an effect is independent of which excited state the system is in, we will simply write |e .
There are higher energy states, for instance, the state with both an extra electron and an above-gap quasiparticle on the island, that we have not discussed. Throughout this work, our aim will be to identify the lowest order errors: the most prominent errors in the system. If the probability of a given error is less than or equal to the product of the probabilities of other errors, and the effect on the Hilbert space of the MZMs is the same for that particular error as for the combination of the other errors, then we call such an error higher order. Processes involving excited states other than |e ∆ and |e C,± can be described as higher-order errors, see Appendix A. Note that an error is classified as higher order solely from its probability; it is possible for the physical process causing a particular higher order error to be distinct from the physical processes causing lower order errors. Figure 5 schematically illustrates single island error processes involving quasiparticles. A transition between the ground and an excited state corresponds to the application of a single Majorana operator and thus sets the probability of a quasiparticle event. The combination of an excitation and a relaxation, or a transition between excited states, corresponds to the application of an even number of Majorana operators. These processes therefore contribute to the probability of a pair-wise dephasing event. We first quantify the transition rates involving quasiparticles in a single island, before discussing correlated events between islands connected during a measurement and error processes that do not involve quasiparticles. In the rates given below, we only quote the parametric dependence and ignore prefactors of O(1).

Thermally excited quasiparticles
Thermal excitation of an above-gap quasiparticle, the top left process in Fig. 5 |g → |e ∆ , is present in all MZM systems. This process occurs, for instance, when a Cooper pair breaks into two electrons, one of which occupies one of the nonlocal fermionic states formed by the MZMs while the other occupies a state in the continuum above the superconducting gap. Thermal excitation of a quasiparticle preserves the total fermion parity of the island and can therefore occur in an isolated system. 5 Crucially, in equilibrium, thermal excitation of a single quasiparticle to the state |e ∆ is exponentially suppressed in the ratio ∆/T , where T is the temperature of the system. 5 There are also thermal excitations that conserve the parity of the MZMs by exciting a pair of quasiparticles to the continuum. These processes have an energy cost greater than twice the superconducting gap and are therefore less likely to occur. In practice, there will be a competition between a power-law enhancement for creating a particle-hole pair since it can happen anywhere in the system, and the additional exponential suppression due to the higher energy cost. Thermally excited particlehole pairs do not cause errors by themselves, but increase the chance of subsequently transitioning to states that flip the MZM parity. Furthermore, pair-excitation can cause correlated events when nearby superconducting islands are coupled together for a measurement. For now we assume that these effects can be qualitatively captured by the transition rate of a single quasiparticle excitation and the rates describing correlated events.
The excitation and relaxation rates take the form where τ 0 is a characteristic time scale describing the electron-phonon coupling of the system. For InAs wires with an Al half-shell, τ 0 ∼ 50ns [23]. In the presence of nonequilibrium quasiparticles, the factor exp(−∆/T ) is essentially replaced by the number of quasiparticles in the vicinity of the MZMs. A single thermal excitation event takes the computational (MZM) state of the island from an even parity state to an odd parity state, while a relaxation event does the reverse. Both thermal excitation and relaxation apply a single Majorana operator γ a to the computational state, although as can be seen from Eqs. (13) and (14) the corresponding rates are significantly different. This is the underlying reason why all of the noise models of Section 2 account for quasiparticle events with two different probabilities, p qp . Furthermore, the application of a single quasiparticle event significantly changes the probability of future quasiparticle events, which is why our noise models only allow for a single noise event to occur in step 0, and a single noise event to occur in step 1(a) (this approximation is justified if the errors are sufficiently rare).
A pair-wise dephasing event can result from an excitation and subsequent relaxation of a thermal quasiparticle. The relaxation event is equally likely for all Majorana operators on the island, regardless of which Majorana operator was applied for the excitation event: this is the underlying reason why we allow for all pairs of Majorana operators, including the same Majorana operator twice, when considering pairwise dephasing in our noise models. Finally, notice that the rates of thermal excitation and relaxation are unaffected by whether or not the superconducting island is involved in a measurement.

Extrinsic quasiparticle poisoning
Extrinsic quasiparticle poisoning, the top right process in Fig. 5 |g → |e C,± , is when a quasiparticle tunnels onto or off of the superconducting island, thereby changing the total fermion parity and charge of the island. We focus on the lowest-energy poisoning events where quasiparticles tunnel onto (off of) the island and into (out of) one of the fermion states provided by the MZMs. In the following discussion, we will assume n g = 0 so that adding an electron to, or taking an electron off of the superconducting island costs an energy E C ; the following expressions could be made more general by replacing E C with E C (1 ∓ 2n g ). For an external quasiparticle to enter the island, it has to overcome the energy barrier E C +δµ, where δµ = µ is −µ res denotes a possible difference in the chemical potentials (a voltage bias) of the reservoir and the island.
In the case of tetrons, the most likely source of quasiparticles is the quantum dot explicitly coupled to the MZMs during a parity measurement. When the quantum dot is tuned to resonance 6 , the energy difference δµ = 0. Transitions between |g and |e C,± are then described by the rates where g T (k) is the dimensionless conductance between the quantum dot and MZM island. The parameter δ is either the level spacing of the quantum dot δ dot when an electron transitions from the quantum dot to the island, or the effective MZM level spacing ∆ when an electron transitions from the island to the quantum dot. Equations (15)- (16) can also be generalized to conductance-based measurement schemes [15,40]. In that case, δ dot is replaced by the temperature T and g T (k) is the dimensionless conductance between the lead and the MZM island. In the case of a quantum dot connected to the superconducting island, only a single channel with transmission T (k) contributes to the island-dot coupling, thus g T (k) = |T (k) | 2 . The transmission T (k) is essentially zero for k = 0 (i.e., no measurement), and becomes appreciable for k = 1, 2. Notice also that during the measurement, the quantum dot is tuned close to the charge degeneracy point, thus we do not have to pay extra energy to remove a particle from it. If the quantum dot is then tuned to the bottom of its charging parabola when a measurement is not being performed, then E C → E C + E QD C in Eq. (15), further protecting the system from quasiparticle poisoning. It thus follows that quasiparticle poisoning from the quantum dot is significantly more likely during a measurement. This motivates why the noise models MC and PMC allow for different probabilities of quasiparticle events and pair-wise dephasing when an island is involved in a measurement.
Alternatively, quasiparticles could come from nearby metallic gates, for example those used to tune the MZM island into the topological regime. The transition rates are now independent of whether a measurement is being performed, as this is not expected to change the coupling between the island and the gate. If the metallic gates are kept at a large voltage, the energy |δµ| may become much larger than E C so that it could be favorable for an extra quasiparticle to be on the superconducting island. In this case, it is essential that the dimensionless conductance between the metallic gate and the island g env is sufficiently small so that the island is not constantly being poisoned by quasiparticles. Since an insulating barrier to the gates suppresses g env exponentially in the thickness of the barrier, sufficiently small values of g env are possible in practice. In the following, we assume that extrinsic quasiparticle poisoning rates are well approximated by Eqs. (15) and (16).
From Eq. (15), we see the benefit of the island having a large charging energy is to suppress the rate of extrinsic quasiparticle poisoning events. Majorana-based quantum computing proposals for which the superconducting island is grounded (E C → 0) are likely to be more susceptible to quasiparticle and pair-wise dephasing events.
A comment is in order about the fast relaxation of Eq. (16). A crucial requirement is that the environment can accept or provide an electron at no energy cost. This is always the case for conductance-based measurements in which the island is connected to leads with no charging energy. For quantum dot-based measurements, it is important to properly initialize and decouple the quantum dots. An example procedure that always allows for fast relaxation is a double-dot measurement (see Fig. 4 right panel). By initializing the quantum dots in the state |0 d |1 d and tuning them so that each dot is at its charge degenerate point, the island can relax its charge state by transitioning to the |1 d |1 d or |0 d |0 d state. Alternatively, we can use the quantum dots to check if a poisoning event has occured during the measurement by performing an additional charge measurement of the quantum dot(s) after the island is decoupled. This additional measurement could allow immediate correction of extrinsic quasiparticle poisoning events, in which case we would not need to include such events in the noise models.
In terms of the computational state of the island, extrinsic quasiparticle poisoning has the same effect as the corresponding thermal quasiparticle event: an excitation, |g → |e , takes the MZMs from an even parity state to an odd parity state by applying a single Majorana operator γ a ; relaxation, |e → |g , does the reverse; and the combination of an excitation and subsequent relaxation, |g → |e → |g , applies the pair of Majorana operators γ a γ c where a can equal c. Transitions between the excited states |e C,± and |e ∆ have the same effect on the computational state as a combined excitation and relaxation. Moreover, a transition between excited states requires two unlikely processes to occur: first, an island must be excited and second, the island must transition to the other excited state before relaxing to the ground state. It follows that such transitions only contribute a small correction to the probability of pair-wise dephasing events and can therefore be neglected.

Correlated events
Quasiparticle poisoning and thermal excitations can lead to correlated events that transfer excitations between two (or more) islands connected during a measurement. An excited charge state can be transferred by a quasiparticle tunneling between two islands through the low-energy subspace provided by the MZMs. A thermal excitation can be trans-ferred without changing the net particle number by an abovegap quasiparticle tunneling between two islands and a corresponding reverse tunneling of an electron through the low energy subspace. Each time an island transitions between the ground and an excited state, a Majorana operator is applied to the computational state of that island. Thus, a process in which two islands swap being in the ground and excited state, results in a Majorana operator being applied to each island. The corresponding MZMs are tunnel-coupled to the same quantum dot, as shown in the right panel of Fig. 4 (either γ 2,m γ 3,m or γ 2,m γ 3,m ). When this process combines with excitations and relaxations on the two islands, it results in correlated events involving three or four Majorana operators between two islands, described, e.g., by the probabilities p (2) cor,odd and p (2) cor,even , respectively, in PMC. The most prominent correlated events come from the processes where the excited states |e x ∈ {|e C,± , |e ∆ }. Equation (18) applies an even number of Majorana operators and is described by the probability p (2) cor,even in PMC. If relaxation processes are fast compared to the time step τ , this is the most probable type of correlated event. Equations (19) and (20) describe odd correlated events captured by p (2) cor,odd in PMC and can be seen as being part of an even correlated event split up over two time steps. Both odd correlated events have the same effect on the computational subspace and are equally likely. To simplify our noise models, we only take into account the process described by Eq. (19). When connecting the probabilities defining PMC to physical processes, we therefore have to overestimate the probability of the event described by Eq. (19) by at least a factor of two in order to avoid undercounting odd correlated events. Similarly to the previous discussion of single-island errors, we ignore higher order correlated events between the two islands, e.g., |e C,± ⊗ |g → |e ∆ ⊗ |e ∆ , see Appendix A.
Assuming the islands are identical, there is no energy difference between the states |e x ⊗ |g and |g ⊗ |e x . As such, the corresponding transition rates have no exponential suppression: where g is-is is the dimensionless conductance between the two islands. The second line originates from the tunneling of an above-gap quasiparticle (level spacing δ is ) and a tunneling through the MZMs (effective level spacing ∆) within the time 1/E C of the virtual charge and thermal excited state. Note that for weak coupling to the dots, the interisland conductance g is-is g (k) T , and grows quadratically with the tunneling amplitude to the dots. Despite the smaller prefactor of Eqs. (21) and (22), the corresponding rates are expected to be much larger than those given in Eqs. (13) and (15) due to the absence of exponential suppression. It follows that an excitation on one island moves to the other with higher probability than an independent relaxation of one island and excitation of the other; this is what is meant by a correlated event.
Processes in which |e x ⊗ |g → |g ⊗ |e y with x = y are a combination of transitions between excited states |e C,± ↔ |e ∆ and the same-state correlated events of Eqs. (21) and (22). We thus expect the corresponding transition rates to only contribute a small correction to the correlated event probabilities in PMC, for the same reason that transitions between excited states only contribute a small correction to the probability of a pair-wise dephasing event.

Other errors
Processes that do not involve quasiparticles can also contribute to the probabilities of pair-wise dephasing events and measurement bit-flips. Finite MZM hybridization, δE ab in Eq. (6), leads to dephasing of the MZMs associated with operators γ a γ b . The MZM hybridization is caused by finite overlap of the MZM wavefunctions when the correlation length of the topological superconductor is not sufficiently smaller than the distance separating the MZMs. The degeneracy splitting can have both a constant and fluctuating piece. The former would be problematic for topological gates that rely on degeneracy of the computational subspace, but will not be explicitly considered here. The latter is problematic even for memory storage. Charge noise in the electrostatic gates and substrate on which the MZM island is sitting can cause fluctuations of the electric field at the topological wire, which in turn results in a noisy time-dependence of the MZM hybridization δE ab . We expect the rate of such errors to scale as where S EE (ω) is the spectral function of electric field fluctuations in the system and L is the typical separation of MZMs in the island. Any computing approach that involves tuning a superconductor into the topological regime with electrostatic gates will likely experience noise described by Γ EE , however, as discussed in Ref. [23], the time scales associated with this dephasing process are predicted to be quite long for reasonably-sized systems (order of minutes for L/ξ ∼ 30). At these system sizes, the thermal excitations of Eq. (13) become the most important source of pairwise dephasing events. For concreteness, we use this limit and ne-glect hybridization-based errors for the probability estimates in the next section. Another source of error occurs when the classical bit storing the outcome of a 2k-MZM parity measurement does not agree with the actual parity of the measured MZMs at the end of the time step. Physically, the measurement is implemented by adding a term to the Hamiltonian with the 2k Majorana operators to be measured. This term splits the energy of the two eigenstates of 2k-MZM parity and the environment then quickly dephases these two states, collapsing the system into one of the eigenstates. The measurement outcome is obtained by gathering statistics throughout the time step as to which eigenstate the system has collapsed.
There are two ways for measurement outcomes to disagree with the state of the system at the end of the time step: (1) the classical bit storing the measurement is flipped, or (2) the state of the system changes between the measurement projection and the end of the time step. Errors from case (1) are described by the probability p (k) mst in MC and PMC (probability p mst in QpBf). This case either results from statistical error (the integration time of the measurement was too short), or from classical noise in the measurement flipping the bit's outcome. Classical noise is strongly dependent on the physical implementation of the measurement, as such, we do not further analyze these processes other than to note that a measurement error will be more probable for smaller measurement signals, likely to occur when multiple islands are involved in a single measurement.
Due to our convention that measurement projections are performed at the end of a time step, our models do not describe case (2). In reality, a measurement is performed by collecting statistics throughout the time interval, thus the measurement result will likely reflect a noise event that occurs near the beginning of the time step, but not one that occurs at the end. The latter are instead reflected in the next measurement that occurs. In an error correction protocol in which almost every island is measured in each time step, it is only a small effect (for a large number of time steps) whether we apply projectors at the beginning or the end of a time step, as for one convention the noise events will be reflected in the measurement associated with that time step, and in the other convention the noise events will be reflected in the measurements associated with the subsequent time step.

Error probabilities
We now use the transition rates discussed in the previous section to estimate how the error probabilities in the stochastic Majorana noise model PMC depend on physical parameters of the system. These estimates serve the double purpose of connecting the noise models of the previous section to the underlying physical system, and of simplifying the simula- cor,even are for both islands in a measurement. In the text, we relate these small, dimensionless parameters to the transition rates discussed in the previous section. When m = 2, corresponding to a tetron architecture, and r k = 0, corresponding to no odd Majorana operators, the model PMC reduces to the qubit-based model Pauli circuit noise.
tions of pseudo-thresholds in the next section by reducing the number of independent parameters in PMC. At the end of this section, we discuss the other three Majorana noise models Qp, QpBf, and MC, and the limit in which they reduce to the analogous qubit-based noise models.
In Fig. 6, we schematically show that for a k-island measurement, all errors involving quasiparticles are related by three small dimensionless parameters: p k , the probability that a quasiparticle is excited on one of the islands involved in the measurement; q k , the probability that the energy from this excitation is transferred to a different island involved in the measurement; and r k , the probability that an excitation created during the time step does not relax. These dimensionless parameters are related to the three types of transition rates involving quasiparticles discussed in the previous sections: excitations Γ (k) g→ex , energy transfers between islands Γ (2) ex,g→g,ex , and relaxations Γ (k) ex→g , respectively. More explicitly, denoting the length of the time step by τ , we find The factor of 2m in Eq. (24) comes from any of the 2m MZMs on an island initially being excited. We assume that excitations are rare, so that Γ (k) g→ex τ 1 and p k is a small parameter. For an idle MZM, we expect extrinsic quasipar-ticle poisoning to be negligible, thus only Γ (0) g→e ∆ will contribute to p 0 . Generally, we expect Γ ex→g is the typical time scale over which the longest living excited state relaxes to the ground state. We assume τ (k) r τ based on physical considerations. The parameter τ is bounded from below by the longest measurement time, a four-MZM parity measurement in the current discussion. We expect this measurement time to be 1 − 10 µs for high-fidelity measurements, while typical time scales for the electron-phonon coupling facilitating quasiparticle relaxation are ∼ 0.1 µs [45]. Physically, we expect 0 < r k < 1/10 and r 0 ≈ r 1 ≈ r 2 . The probability of an excitation, created at the beginning of the time step, to not relax is exponentially small in 1/r k and will be neglected through the remainder of the paper. Equation (25) then follows from the probability of a given excitation to happen withing the window τ (k) r just before the end of the time step. When r k = 0, an island never ends (or begins) a time step in an excited state; for m = 2, the noise model then reduces to the qubit-based model Pauli circuit noise. If the assumption of r k 1 is violated, excitations become longlived. In this case, excitations can travel long distances before relaxing, thereby significantly degrading the effectiveness of error correction. We discuss noise models describing long-lived excitations in Appendix B.
For simplicity, and to obtain an upper bound on the correlated errors in Eq. (26), we maximize the probability for transferring energy over the excited states. Since q 2 is not exponentially suppressed and can therefore be O(1) when islands involved in a measurement are well-coupled, we did not use the approximation for small transition rates. Physically, we expect the probability of an energy transfer between the two islands to be smaller than the probability that the excitation remains on the same island, so we anticipate 0 < q 2 < 1/2. For an idle island or single-island measurement, q 0 = q 1 = 0.
In the following, we describe the noise model PMC using the parameters introduced above.
Quasiparticle events. The probability p (k) qp that a single Majorana operator is applied to an island involved in a 2k-MZM measurement can be obtained from considering an initial excitation (p k ) of a quasiparticle that does not relax (r k ) and does not transition to another island (1 − q k ). We therefore find The probability p (k) odd of an initially excited state to relax during the time step is given by The bound in Eq. (29) reflects the assumption of fast relaxation. In that case, it is more likely for an excitation to relax and get re-excited, than for the excitation to remain over the entire time step. Within the fast relaxation limit, we can use the upper bound for 1 − p qp . We discuss how the noise models can be generalized beyond the fast relaxation limit in Appendix B.
Pair-wise dephasing events. Pair-wise dephasing events can occur from quasiparticle excitations and relaxations, or from non-quasiparticle processes such as MZM hybridization discussed in Section 3.2.4: Here, (1 − q k )(1 − r k ) is the probability of an excited quasiparticle to relax within the same island and thus contribute to pair-wise dephasing. The second term arises from noise in the hybridization, see Eq. (23). The combinatoric prefactor of m counts the number pairs of MZMs whose wavefunction overlap contributes to pair-wise dephasing. In the following, we will assume the MZMs are sufficiently separated that we can drop the second term.
Correlated events. An odd correlated event occurs when one island involved in a measurement is excited and transfers its excess energy to a second island, which remains in the excited state for the rest of the time step. Similar to quasiparticle events, only excitations within a fraction of r k of the time step contribute significantly to odd correlated events. More explicitly, the probability of an odd correlated event is p (2) cor,odd ≈ 2 p 2 q 2 r 2 .
The factor of two is a result of the initial quasiparticle excitation occurring on either of the two islands involved in the measurement. An even correlated event occurs when a quasiparticle excitation in one island is transferred to the other island, which subsequently relaxes: The factor of two again comes from either island initially being excited. When hybridization errors are subleading (i.e., the MZMs are sufficiently well-separated), an even correlated event is essentially a pair-wise dephasing event interrupted by an energy transfer.

Probabilities
Qp cor,odd = 2p2 q2 r, pmst Table 2: Probabilities for pair-wise dephasing, quasiparticle, and correlated events in the four stochastic Majorana noise models can be written in terms of an excitation parameter p k (p), a relaxation parameter r, and a correlation parameter q k (with q0 = q1 = 0), see Eqs. (24)(25)(26). The expressions above neglect the contribution of hybridization to pair-wise dephasing events, and assume that quasiparticle relaxation times are fast, i.e, p Measurement bit-flip. A measurement bit-flip depends only on classical and statistical noise, and is thus independent of the other probabilities in the noise model. The signal-tonoise ratio of a measurement typically increases as a square root of the integration time [46]. We assume that τ is essentially given by the integration time of the measurement. The confidence of the measurement outcome therefore behaves as p (k) where τ mst is a characteristic time scale that gives a signalto-noise ratio of 1. Four-MZM measurements are expected to have lower visibility and thus be more susceptible to statistical and classical error, i.e., p mst < p (2) mst .
We have shown that the probabilities defining model PMC can be defined in terms of excitation parameters p k , relaxation parameter r k , and a correlation parameter q 2 . Varying these parameters over the appropriate ranges and studying the effect on the pseudo-threshold for the system should inform us about the relative importance of single-island vs. two-island errors, as well as errors with an odd vs. even number of Majorana operators. A natural choice for the three other stochastic Majorana noise models is to assume a similar dependence of the probabilities on these parameters. In the next section, for ease of comparing the effects of different errors, we will set r k = r and use the lower bound of the relaxation probability p qp . We summarize the scaling relations between error probabilities for the four models in Table. 2.
Finally, note that if we set p 0 = p 2 and restrict our attention to tetrons (m = 2), the noise models MC and PMC differ only in that some of the odd correlated events in MC do not occur in PMC. For both MC and PMC, there are only 16 computationally distinct 7 even correlated events, each occurring with equal probability. In contrast, there are 16 computationally distinct odd correlated events that can occur in PMC with equal probability, and 32 computationally distinct odd correlated events that can occur in MC with equal probability. For larger values of m, we expect MC and PMC to differ more substantially.

Application of noise models
We now apply the noise models presented in Section 2 to analyze the error correction performance of the Bacon-Shor code [37-39] on a small system of tetrons. As explained in Section 3, a tetron consists of four MZMs, and therefore stores a single qubit of information in the overall even parity state. Although our noise models can be applied to any quantum error correction scheme, there are several motivations for considering this small subsystem code rather than (1) a Majorana fermion code specifically designed to correct for quasiparticle events [24,34,35], or (2) a qubitbased stabilizer code (e.g., the surface code). (1) A Majorana fermion code either requires the ability to measure the total parity of all MZMs on an island, or the ability to dynamically adjust the number of MZMs on a given island. We discuss in Section 5 why it is experimentally challenging to satisfy these conditions. Furthermore, the codes discussed in Ref. [35] are categorized with a notion of code distance in which the most probable noise events are quasiparticle events, which is not expected to be the case for a tetron architecture. Rather, for low temperatures (T E C , ∆) and fast relaxation (r k 1), quasiparticle events in a system of tetrons are converted by the environment into Pauli errors, which in turn are correctable by qubit-based codes. As discussed in Section 3.1, the odd total-MZM parity state of an island is highly excited above the (even MZM parity) ground state; as such, the environment relaxes the system back to the ground state. In the language of Refs. [34,35], the environment measures the missing stabilizers of the Majorana fermion code needed to detect errors involving odd numbers of Majorana operators.
Regarding point (2), in the Bacon-Shor code, error correction is built out of two-qubit measurements, which can be simply implemented for tetrons with four-MZM parity measurements. In contrast, typical stabilizer codes involve measurements of at least four-qubit (eight Majorana) operators, which are expected to be more difficult to implement experimentally. While in principle it is possible to implement higher-weight measurements from a sequence of smallerweight measurements, the extra operations can significantly increase the noise. For example, a six-MZM measurement for a system of tetrons could be performed using two ancilla tetrons with six four-MZM and four two-MZM measurements [41], or alternatively by preparing ancilla tetrons in a cat state, then doing a sequence of four-MZM measurements [32]. Adding ancilla tetrons and additional measurements provides new locations and opportunities for noise to occur before it can be corrected by the code. Additionally, as is further discussed in Section 6, higher-weight measurements can result in a higher probability of correlated errors, with negative effects on the pseudo-threshold. Circumventing higher-weight measurements using subsystem codes is therefore a natural starting point for error correction in Majorana-based quantum computing architectures. Determining optimal error correction procedures by weighing the advantages and disadvantages of higher-weight measurements is an interesting direction for future research.
We review error correction with subsystem codes, focusing on the Bacon-Shor code and how it applies to a system of tetrons. We then analyze the conditions for fault tolerance (i.e., compute pseudo-thresholds) for each of the noise models presented in Section 2. The analysis of this section is restricted to quantum memory error correction; analyzing the fault tolerance of logical gates is an important subject that we relegate to future studies. The choice of error correcting code and error correction protocol have not been optimized to minimize the number of resources [47,48] or to maximize the fault tolerance threshold [49]. As such, the pseudo-threshold values reported here are more informative in their relative magnitude (within a given noise model for different parameter values) than in their absolute value. At the end of this section, we separately discuss what experimental implications can be drawn from our analysis.

Subsystem error correcting codes
As subsystem codes are less commonly studied compared to stabilizer codes [42], we first review the standard application of a subsystem code to a qubit noise model (i.e., errors involving an even number of Majorana operators in a tetron architecture). For a more extensive discussion of subsystem codes, see Ref. [50]. We then discuss how a subsystem code can also correct for errors involving an odd number of Majorana operators in a tetron architecture. We address measurement bit-flips later when discussing the application of the Bacon-Shor code to the noise models of Section 2. An example illustrating the formal concepts introduced below is given in Section 4.2.
Subsystem codes are generalizations of stabilizer codes in which information is encoded in a subsystem of a subspace of the Hilbert space, rather than a subspace. More explicitly, the Hilbert space of physical qubits H can be decomposed into a code space H C and the perpendicular subspace of er- The code space can be further decomposed into a logical subsystem H L , the Hilbert space of the logical qubits, and a gauge subsystem H G : In a stabilizer code, H G is trivial. The benefit of having the gauge subsystem is that error correction only needs to correct an error modulo the gauge subsystem structure; a nontrivial action on the gauge subsystem does not affect the encoded quantum information. As we detail below, this extra degree of freedom can allow the error correction procedure to be implemented directly with smaller measurements, but comes at the cost of a reduction of the number of inequivalent code states. More formally, we specify a subsystem code using subgroups of the Pauli group for n physical qubits, P n : • The gauge group, G: a non-Abelian subgroup of P n which defines the subsystem code.
• The stabilizer group, S(G): the largest subgroup of G, excluding −1, consisting of elements which commute with every element of G.
• The group of bare logical operators, L B : Pauli operators that commute with, but do not belong to, the gauge group G.
• The group of dressed logical operators, L D = L B , G .
The code space, H C (G), of a subsystem code with gauge group G is the +1 eigenspace of all stabilizer operators. The code distance, d, is defined to be the minimum support of any logically non-trivial element of L D . We use the standard qubit definition of code distance, not to be confused with the Majorana fermion code distance used in Refs. [24,34,35]. Error correction with a subsystem code involves using the measurement outcomes of the generators of the stabilizer group (stabilizers) to infer if any unwanted Pauli noise operators have been applied to the system 8 . One of the most appealing features of subsystem codes is that the eigenvalue of each stabilizer generator can be determined by multiplying together the eigenvalues of some of the gauge generators, which are often easier to measure. For an example of gauge generators and stabilizers, see Fig 7. To model memory error correction, the system is prepared in an eigenstate of one of the logical operators and is periodically measured to check that the state remains unchanged. If at least one, but fewer than d, Pauli errors occur in an error correction round (measurement of all stabilizers), the system will no longer be in H C (G) and some of the stabilizer measurements will have outcome −1. The syndrome of a given Pauli error is the corresponding set of stabilizer measurement outcomes. The error correction protocol uses the syndrome to infer which Pauli operators have been applied (under the assumption that the minimal number of errors corresponding to that syndrome has occurred). The errors can then be corrected by appropriate application of Pauli operators, returning the system to its intended state. However, if more than (d − 1)/2 Pauli errors occur in an error correction round, the correction procedure might incorrectly diagnose the error; in this case, the correction procedure might change the logical state of the encoded quantum information, resulting in a failure of the error correction protocol.

Bacon-Shor codes
One particular subsystem code, the distance-d Bacon-Shor code, is implemented on a d × d grid of qubits, with d odd [37,38]. Figure 7 shows the relevant operators of the d = 3 Bacon-Shor code. The generators of the gauge group G are XX acting on horizontal nearest neighbors and ZZ acting on vertical nearest neighbors, as depicted in Fig. 7(a). The stabilizer group S(G) has d−1 X-type and d−1 Z-type generators, where each X-type generator consists of X applied to two columns (2d qubits) and each Z-type generator consists of Z applied to two rows (2d qubits), see Fig. 7(b). A Z-type bare logical operator is a string of Z operators applied to a row of qubits [ Fig. 7(c)], and an X-type logical operator is a string of X operators applied to a column of qubits [ Fig. 7(d)]. Applying a stabilizer operator to a bare logical operator results in an equivalent bare logical operator. Application of a gauge operator to a bare logical operator results in an equivalent dressed logical operator.
For the distance-d Bacon-Shor code (d = 3 in Fig. 7), a single X error in a given row will anti-commute with any Z-type stabilizer with support in that row and will therefore have the same syndrome as all other X errors in that row. This ambiguity does not cause any problem for error correction as X errors belonging to the same row differ from each other by a gauge generator, and thus are corrected by the same procedure: applying a single X operator to one qubit in the row. In order to find each stabilizer measurement outcome, it is enough to measure the d two-qubit gauge generators and multiply the outcomes (e.g., three two-qubit measurements for the d = 3 code shown in Fig. 7). Single-qubit Z errors can similarly be identified by finding the eigenvalues of the stabilizer generators, and corrected by applying a single Z operator to any qubit in the same column.
In the following, we imagine a distance-d Bacon-Shor code implemented in a tetron-like architecture (see Fig. 2) using 4d 2 MZMs. The jth qubit hosts four MZMs, γ j,1 , γ j,2 , γ j,3 , γ j,4 , and we identify the corresponding Pauli operators as (When analyzing noise model PMC, we will alter this definition to take into account the geometric arrangment of the MZMs on the island, see Fig. 13. Specifically, we use the parity conservation of the ground state so that X j = γ j,1 γ j,4 or γ j,2 γ j,3 depending on whether a tetron is in a joint measurement with its left or right neighbor; similarly Z j = γ j,1 γ j,2 or γ j,3 γ j,4 depending on whether a tetron is in a joint measurement with its top or bottom neighbor.) Using Eq. (36), we can map each Pauli operator to a MZM-parity measurement. Furthermore, we assume that corrections are applied as Pauli frame updates: rather than actually applying an operator to correct an error, we classically track measurement outcomes and appropriately reinterpret subsequent measurement outcomes. As such, we can assume corrections are perfect, since faulty measurements are already taken into account.
We can choose to apply all Z corrections (Pauli frame changes) to the qubit in the appropriate column in the top row and all X corrections to the qubit in the appropriate row in the left column. The stabilizer measurements are decoded by assuming that the minimal number of Pauli errors corresponding to a given syndrome have occurred (we will explain how to treat measurement bit-flips in the next section). For the d = 5 Bacon-Shor code, any two-qubit Pauli error can be corrected in this way [37], see Fig. 8(a) for an example. However, some three-qubit Pauli errors will be misdiagnosed by this decoding scheme, and can result in a logical operator being applied to the system after the correction step, see Fig. 8(b). In this case, the quantum information stored in Figure 8: Two examples of Pauli errors (red and blue stars) and corresponding error correction (solid red and dashed blue circles). All X errors in the same row and all Z errors in the same column have the same syndrome. (a) Example correction of a single X and a single Z error. The net Pauli operator applied to the system (errors and correction) is in the gauge group and thus does not change the quantum information stored in the code. (b) Example failure of the code for three X errors. They syndrome of the three X errors is the same as the syndrome for two X errors in the third and fifth rows. The correction thus applies X operators to these rows, so that the net operator (error and correction) applied to the system is a dressed logical operator, which changes the quantum information.
the code has changed, resulting in a failure of the protocol.
Note that the stabilizer measurements do not distinguish between the even and odd parity subspaces of the qubits: this can be seen with the mapping in Eq. (36) by noting that γ j, 4 does not change any of the stabilizer outcomes. Therefore, every error involving an odd number of Majorana operators has the same syndrome as some error involving an even number of Majorana operators. Using the decoder described in the previous paragraph, all syndromes will be interpreted as corresponding to an error involving an even number of Majorana operators, thus the correction step (applying an X operator to a qubit in the left column or a Z operator to a qubit in the top row) will not return the system to the even parity subspace. However, when the system relaxes back to the ground state in a later time step, it either does this through application of a Majorana operator that does not change the stabilizer measurement outcomes (in which case the environment has self-corrected), or the stabilizer measurements are altered and the error correction procedure now identifies the Pauli error resulting from the combined initial excitationintermediate correction steps-relaxation processes. Note that when the excitation-relaxation process extends over more than one time step the outcome of subsequent stabilizer measurements might disagree. For example, an initial γ j,2 excitation would be interpreted as a Y j error. If there is a subsequent relaxation to, say, γ j,3 the combined process corresponds to an X j error. The above process can lead to mis-interpretation of the error and can therefore be thought as contributing to measurement errors, which we discuss more in Section 4.4. We say that the protocol works if the correction step after the system has returned to the even parity subspace (possibly in a later time step) has applied a stabilizer operator. Conversely, if the correction step after the qubit returns to the even parity subspace results in a logical error, the protocol fails.

Fault tolerant error correction
A distance-d error correcting code could be used to protect against up to (d − 1)/2 errors with a single round of perfect measurements. To account for the fact that some noise models can have imperfect measurements, a framework known as fault-tolerant error correction has been developed. This framework distinguishes between faults and errors: • A fault is any noise event that adversely disturbs the system or the measurements.
• An error is any non-trivial operator applied to a qubit.
For a qubit-based model, a fault corresponds to any nontrivial noise event (including measurement bit-flips) and an error is some single-qubit Pauli operator (we will generalize the discussion to Majorana noise models at the end of this section and clarify what is meant by a noise event that "adversely disturbs the system"). Faults are defined with respect to a given noise model; we illustrate this point by considering the qubit-based noise models Pauli noise with bit-flip measurement and Pauli circuit noise. For the former, a single fault is either a single-qubit Pauli operator or a measurement bit-flip. For the latter, a single fault can be a single-qubit Pauli operator, a two-qubit Pauli operator, or a measurement bit-flip. Notice that if a noise model includes correlated events, a single fault can result in multiple errors. For a given qubit-based noise model, the requirement that the error correction procedure is fault-tolerant amounts to satisfying the following conditions [51]:

(EC A): For any initial state (irrespective of whether
or not it is a code state), a single fault that can occur anywhere during the error correction procedure results in an output which differs from a code state by at most (d − 1)/2 errors.

(EC A'):
For an initial error-free code state, a single fault that can occur anywhere during the error correction procedure outputs the error-free code state.

(EC B):
If the error correction proceeds without additional faults, any code state with (d − 1)/2 errors will be corrected.
If the noise is sufficiently weak, information stored in a faulttolerant error correcting code is better-protected than information stored directly in a physical qubit. The performance of a fault-tolerant error correction scheme can be quantified by the pseudo-threshold, defined for a noise model characterized by a single parameter p by where p err is the logical error rate, i.e., the probability of an uncorrectable error remaining in the system after the application of strength-p noise and error correction. The pseudothreshold will depend on the noise model, the error correcting code, and the error-correction protocol. A pseudothreshold is defined for a particular error correcting code on a fixed number of qubits, in contrast to a threshold which is defined for a family of error correcting codes, each for different system size (i.e., a different number of physical qubits). The threshold is the limit of the pseudo-threshold for infinitely large system size. The Bacon-Shor code family does not have a finite threshold. For a Majorana-based system, any non-trivial string of Majorana operators applied to a single island results in an error. A fault is more subtle. For instance, some noise events are a result of the system relaxing back to the even parity ground state. This relaxation does not necessarily occur within the same time step as excitation, which is why our models include noise events involving an odd number of Majorana operators (i.e., quasiparticle and odd correlated events). When using a qubit-based code (i.e., a code that only corrects for Pauli errors on the qubits) to error correct a Majorana-based system, it is essential for the environment to relax the system to the even parity ground state so that the net operator applied to any island involves an even number of Majorana operators (and therefore corresponds to some Pauli operator). This motivates a careful specification of what is considered "adversely disturbing the system" in the definition of a fault. If an island begins a time step in the odd parity state and a quasiparticle event relaxes the island back to the even parity state, this noise event is beneficial to the error correction protocol and is thus not considered a fault. Conversely, if an island begins or ends a time step in the odd parity state, the lack of a relaxation is a fault. For all the Majorana noise models presented in Section 2, any non-trivial noise event applied during steps 1 or 2 correspond to a fault; a quasiparticle event applied in step 0 is not a fault; and not applying a quasiparticle event in step 0 is a fault.
With the above understanding of what constitutes a fault and what constitutes an error, fault tolerance conditions (EC A)-(EC B) apply to a Majorana-based system. Note that "a single fault" in conditions (EC A) and (EC A') implies that if the fault corresponds to a quasiparticle or odd correlated event in a time step, the excitation is immediately relaxed in the subsequent time step. Simiarly, "without additional faults" in condition (EC B) implies that if the code state with (d − 1)/2 errors is in an odd parity state, then the system is relaxed to the even parity state in the subsequent time step.  Fig. 7, black dots correspond to qubits, red ovals denote X measurements, blue dashed ovals denote Z measurements. Each step involves the measurement of two stabilizers built out of five gauge generator measurements. Four measurement steps are necessary (for arbitrary d) for a single error correction round. As discussed in the main text, faulty measurements can be corrected by repeating each error correction round at least four times. One might, in principle, be able to do multiple measurements on a single qubit and thereby reduce the number of measurement steps required; however, this is inadvisable as it allows correlated errors to spread over longer distances.

Numerical results
In this section, we analyze fault-tolerant error correction circuits for storing a qubit using the d = 5 Bacon-Shor code under the Majorana noise models presented in Section 2. We define the parameters of each noise model according to Table 2, so that we can easily scale the probability of a logical error p err as a function of the probability p 0 of an excitation of an idle island. The analogous qubit noise models are found by setting the probability of all errors involving an odd number of Majorana operators to zero (equivalently, by setting the relaxation parameter r from Section 3.3 to zero).
An exhaustive simulation of all possible errors to find the exact pseudo-threshold p A th of a noise model A quickly becomes intractable. We therefore follow a Monte Carlo approach of simulating n trials runs for a single error correction round to estimate p err (p 0 ) from the fraction of trials which result in a logical error we extract The uncertainty of p err (p 0 ) for a given p 0 is of order 1/ √ n trials .
The Majorana noise models Qp, QpBf, and MC are designed without respect to a specific physical measurement protocol. Thus, when simulating pseudo-thresholds for these three models, we define measurements according to Eq. (36), i.e., without considering the geometric arrangement of MZMs within a tetron. In contrast, model PMC is designed with the measurement protocol of Section 3.1 in mind; as such when analyzing this model we redefine the measurements to account for a convenient physical implementation of the Bacon-Shor code.
There are three main differences between our simulations of models MC and PMC and the most realistic approach to estimating optimal pseudo-threshold values. (The simple models Qp and QpBf will clearly not estimate realistic pseudo-threshold values as they do not include all lowest order noise events in a Majorana-based system.) Firstly, to help the simulations run faster, we do many trial runs of a single error correction round, rather than simulating many rounds and analyzing the frequency of logical errors being applied. 9 The latter approach is a more accurate description of noise in an actual system because it feeds the errors from a previous error correction round into the next. However, feeding errors into the next time step is only important when the system has the unlucky combination of an error going undetected (e.g., from occuring in one of the later time steps of an error correction round and thus being identified as a measurement bit-flip) followed by enough additional errors occuring in the next error correction round to result in a logical error. When the noise event rate is sufficiently small, the difference between simulating many error correction rounds and repeatedly simulating a single round will only result in a small correction to the pseudo-threshold estimates. Details of the code used for simulating the pseudo-thresholds are in Appendix C.
Secondly, to correct for faulty measurements, we use the Shor error correction approach [39] of repeating stabilizer measurements multiple times in a single error correction round. Generally, Steane error correction [52], which uses entangling gates (e.g., CNOTs) of the logical data qubit with logical ancilla qubits to locate errors, results in higher threshold estimates (in part because the effort of error correction is shifted from operations on the data qubits to preparation of ancillas [51]). Steane error correction is only known to apply to stabilizer codes, which means that in order to do Steane error correction on the Bacon-Shor code we must fix the gauge subsystem and thereby lose the ability to build stabilizer measurements out of two-qubit measurements. Furthermore, the logical ancillas (tripling the number of tetrons) and multiple CNOT gates (each using an additional ancilla tetron and multiple measurements [41]) needed for Steane error correction quickly complicate the pseudo-threshold simulations.
Finally, we include correlated events, which reduces the number of faults that can be corrected for models MC and PMC because two faults can result in a logical error (e.g., a correlated event plus a pair-wise dephasing event can implement Pauli errors on three islands). We could have avoided correlated events reducing the code distance by using mea- 9 This approach allows us to speed up the run time by using importance sampling for the first error.  Table 2). The dot-dashed blue line indicates no error correction. The pseudo-threshold is the intersection of the two curves: p Qp th ≈ 0.09. This plot was generated for 10 5 Monte Carlo trials per data point, see Appendix C for simulation details.
surement gadgets [51], which use CNOT gates and ancilla tetrons to ensure that any correlated event only affects one data tetron. However, measurement gadgets introduce more opportunities for a fault to occur within an error correction round due to both the introduction of ancilla tetrons and because CNOT gates require three measurements for a tetron architecture [41]. It is therefore not clear whether measurement gadgets would improve the error correction for tetronbased architectures.
Given the above considerations, we believe the pseudothreshold estimates for models MC and PMC in this section are below their optimal values and should not be taken as experimental targets. Our analysis should rather be taken as indication of the relative importance of the different noise events (quasiparticle, measurement, correlated, and pairwise dephasing) on the pseudo-threshold. In Section 6, we identify future directions of study that could improve simulations of the noise models presented in this paper and result in more accurate pseudo-threshold estimates. We explicitly discuss experimental implications of our analysis at the end of this section.

Quasiparticle noise with perfect measurement (Qp)
Model Qp is the simplest stochastic Majorana noise model given in Section 2, in which only pair-wise dephasing events or quasiparticle events can occur. We define measurements according to Eq. (36). The relative distribution of quasiparticle events and pair-wise dephasing events can be adjusted by varying the relaxation parameter r, see Table 2. In the limit r = 0, Qp reduces to the qubit model Pauli noise (or code capacity noise).
The standard procedure for calculating pseudo-thresholds for Pauli noise is to consider a noisy time step, followed by perfect application of all stabilizer measurements (i.e., errors cannot occur between the four different measurement steps displayed in Fig. 9). We implement the same procedure for Qp, however, since the syndrome of a quasiparticle event after a single time step is identical to that of some pairwise dephasing event, a single time step of Qp is not able to distinguish quasiparticle events from pair-wise dephasing events. The r-dependence of the model will therefore only become apparent after simulating multiple time steps, for instance by considering several error correction rounds or by modeling application of a logical gate (not included in this paper). We do not simulate multiple time steps for Qp, as the simulations of QpBf and MC clearly indicate that the pseudo-threshold only has weak r dependence. The pseudothreshold estimate under Qp (and Pauli noise) for a single time step is p Qp th ≈ 0.09 (see Fig 10).

Quasiparticle noise with bit-flip measurement (QpBf)
The model QpBf builds on the previous model Qp by allowing the classical bit storing the measurement outcome to be flipped. We define the error probabilities in Table 2 and the measurements according to Eq. (36). For this noise model, we repeat the four measurement steps comprising a single round of error correction in order to avoid introducing errors into the code state from a single measurement bit-flip (i.e., we use a Shor error correction scheme). Our procedure is to consider a single (noisy) time step preceding each error correction round, repeated four times. We again apply all stabilizer measurements simultaneously, as in the Qp simulation. If the repetition rounds result in different syndromes, we accept the last syndrome which repeats for two consecutive rounds. When multiple errors occur, it is possible that no two consecutive rounds will have the same syndrome. In this case, we assume the syndrome for the fourth round. The pseudo-threshold dependence on r and p mst is shown in Fig. 11. In the top panel, we see weak dependence on r, with p QpBf th ≈ 8 × 10 −3 for 0 ≤ r ≤ 1/3 and p mst = 10 −4 . It follows that under this noise model, the d = 5 Bacon-Shor code is insensitive to the relative distribution of quasiparticle and pair-wise dephasing events. Intuitively, we can understand this result as follows: in the parameter regime considered, the environment relaxes each island with high probability, thereby converting quasiparticle events in one time step to pair-wise dephasing events in the subsequent time step. A pair-wise dephasing event in one time step does not have a significantly different effect than a pair-wise dephasing event broken into two time steps. As noted in Section 3.3, larger r is not captured by model QpBf and would be highly problematic (see Section 5 and Appendix B), requiring a Majorana fermion code to efficiently correct a sin-   Table 2). Solid curves are the logical error rate as a function of the noise event rate p0, dot-dashed blue lines indicate no error correction, and the pseudo-threshold for each choice of parameters r and pmst is their intersection. These plots were generated for 1.5 × 10 5 Monte Carlo trials per data point, see Appendix C for simulation details. See text for discussion of results.
gle excitation [24,34,35]. The bottom panel of Fig. 11 shows the pseudo-threshold dependence on p mst for r = 1/10. The logical error rate, and therefore the pseudo-threshold, have much weaker dependence on p mst than on p 0 . Intuitively, this insensitivity to measurement bit-flip can be understood as a direct consequence of the repetition of stabilizer measurements: a measurement bit-flip must be repeated in order to show up in the accepted syndrome, whereas a quasiparticle or pair-wise dephasing event occurring in the first time step will affect all subsequent syndromes. We expect p mst to contribute significantly to p err when p mst O √ p 0 10 . This estimate is consistent with the approximately con- 10 One example scenario in which measurement bit-flips contribute to a failure of the error correction protocol is if two single qubit errors occur in the first time step, e.g., x errors on qubits in different columns, and a measurement bit-flip occurs for a qubit in a different column in both the second and third time step (or  Table 2). Solid curves are the logical error rate as a function of the noise event rate per qubit (averaged over the 20 measured qubits and 5 idle qubits in the system), dot-dashed lines indicate no error correction, and their intersections denote the pseudo-threshold for those parameter choices. In the top right panel, the pseudo-threshold for q = 1/10 is ≈ 6.5 × 10 −4 , and for q = 0 is ≈ 9.8 × 10 . The insensitivity to p mst is independent of whether or not there are MZMs in the system and should apply generally to any error correction scheme that relies on repetition to correct for measurement bit-flips. A similar result was found in the context of the surface code built from qubits subjected to Pauli noise with bit-flip measurement in Ref. [53]: for small Pauli error probability (p 0 < 0.01), the probability of a stabilizer measurement bitflip could approach 50% without strongly affecting the logical error rate. In comparison, the probability of a stabilizer both the third and fourth time steps). The same logical error could instead occur if three x errors affecting qubits in different columns occur in the first, second, or third time steps. The two scenarios are similarly probable when p 2 mst ∼ O (p 0 ). measurement bit-flip here is 1 − (1 − p mst ) 10 , which equals 50% for p mst ≈ 0.07.
Finally, we note that in the regime of weak p mst dependence, the pseudo-threshold estimate for QpBf is approximately consistent with the simulation of Qp if the logical error rate is plotted as a function of p 0 /4. If we ignore measurement bit-flips, the simulation for QpBf mainly differs from Qp in that there are four time steps before applying the decoder, thus the QpBf simulation roughly quadruples the probability of a noise event compared to the Qp simulation 11 .

Majorana circuit noise (MC)
The error probabilities for MC are given in Table 2 (here we write q 2 as q). Because we are restricting our analysis to the operations necessary for error correction of quantum memory, during any given time step every island is either idle or involved in a four-MZM measurement with another island. Measurements are still defined according to Eq. (36). It is now important to keep track of which islands are involved in a given measurement, therefore we can no longer assume that all stabilizers are applied simultaneously. Rather, each set of stabilizer measurements (see Fig. 9) is preceded by a noisy time step, so that a single error correction round is comprised of four time steps and four measurement steps. As for QpBf, faults in the measurement process require repetition and we use the same protocol as before: we accept the last repeated syndrome, or if no syndrome repeats, we assume the syndrome for the last round. We show in Appendix D that this repetition scheme satisfies the conditions for fault tolerance.
The simulation results are plotted in Fig. 12. The top left panel shows the dependence on r for q = 1/5 (single-qubit errors four times more likely than two-qubit errors), p 0 = p 2 , and p mst = 10 −4 . The pseudo-threshold dependence on r is even weaker than was the case for QpBf, and is within noise of the simulation for realistic choices of r (including unphysical values of r = 1/2 and 1 does reveal a weak rdependence). This indicates that the code is insensitive to a redistribution of errors involving an even or odd number of Majorana operators. We stress that the insensitivity of the pseudo-threshold to changes in r is highly dependent on the assumption e −1/r k < p k (see Section 3.3) that went into the construction of the circuit noise models. If this were not the case, a single excitation in one island could spread throughout the system through correlated events occurring with probability q ∼ O(1). We comment further on architectures where this inequality is not satisfied in Section 5 and Appendix B.
The pseudo-threshold's dependence on q is shown in the top right panel of Fig. 12 for r = 1/10, p 0 = p 2 , and p mst = 10 −4 . As is expected from similar studies using qubit noise models, we see that a higher weight of correlated events significantly lowers the pseudo-threshold [54]. When all initial excitations in an island lead to correlated events, i.e., q = 1, the pseudo-threshold p MC th ≈ 1.2 × 10 −4 . When half of the errors on a measured island are from correlated event processes, i.e., q = 1/2, the pseudo-threshold increases to the p MC th ≈ 4.5 × 10 −4 . Finally, in the limit of no correlated events, i.e., q = 0, the pseudo-threshold is p MC th ≈ 9.8 × 10 −4 . This last limit agrees with the simulation results for Qp and QpBf by scaling the x-axes of Figs. 10 and 11 by factors of 1/16 and 1/4, respectively, to account for the factor of four increase in the number of time steps that can contribute to a logical error compared to the QpBf

simulation.
The bottom left panel of Fig. 12 plots the pseudothreshold for p 2 = p 0 /2, p 0 , and 2p 0 with r = 1/10, q = 1/5, and p mst = 10 −4 . In order to keep the total probability of an error fixed, the x-axis is now given by (p 0 + 4p 2 ) /5, the average rate of creating an excitation in the d = 5 system. The pseudo-threshold is lower for p 2 > p 0 , which is consistent with our expectation that a higher percentage of correlated events should decrease the pseudo-threshold. This dependence is not especially strong, which can be understood as resulting from the small ratio (1/5) of islands that are idle in any given time step.
Finally, we show the pseudo-threshold dependence on p mst in the bottom right panel of Fig. 12 for r = 1/10, q = 1/5, and p 0 = p 2 . The curves for p mst = 10 −4 and p mst = 10 −3 are essentially within noise of each other, and only for p mst 10 −2 ∼ O √ p 0 does the pseudo-threshold depend noticeably on p mst . The intuition is the same as for model QpBf: measurement bit-flips must be repeated over successive stabilizer measurements in order to affect the accepted syndrome and influence the correction procedure.

Physical Majorana circuit noise (PMC)
For PMC, we follow the same protocol as for MC: every time step is followed by a stabilizer measurement and we repeat the error correction round four times (for a total of 16 time steps, 16 stabilizer measurements, and four sets of syndromes). We assume the last syndrome which repeats twice  Table 2). Solid curves are the logical error rate as a function of the noise event rate per qubit (averaged over the 20 measured qubits and 5 idle qubits in the system), dot-dashed lines indicate no error correction, and their intersections denote the pseudo-threshold for those parameter choices. See text for discussion of the results. The first three plots were generated for 10 8 effective Monte Carlo trials per data point and the bottom right plot was generated for 10 7 effective Monte Carlo trials per data point, see Appendix C for simulation details.
is correct; if no two syndromes are repeated, we assume the last syndrome. As noted at the end of Section 3.3, models PMC and MC applied to a system of tetrons with p 0 = p 2 only differ in a slight redistribution of the odd correlated events. However, since PMC is defined with a particular physical implementation in mind and keeps track of which MZMs are involved in a measurement, we now take into account the geometric arrangement of MZMs on an island to define the measurements. We replace Eq. (36) with the following definitions of an XX measurement of horizontal nearest neighbor tetrons and a ZZ measurement of vertical nearest neighbor tetrons (see Fig. 13): Note that now, for every tetron not located at a corner, each MZM on that tetron is involved in at least one measurement. This is a departure from the case where one MZM (e.g., γ j,4 ) is not touched by any measurement and prevents a one-toone mapping of quasiparticle events and Pauli errors. In particular, a single-MZM error can lead to measurement syndromes that are not described by a local Pauli error. Equations (39) and (40) are more convenient measurements to implement physically; however, there is no fundamental limitation to implementing measurements described by Eq. (36) if the tetron architecture includes additional ancilla islands to facilitate longer-range measurements [41].
The PMC simulation results are shown in Fig. 14. The rdependence, q-dependence, and p mst -dependence of the logical error rate are shown in the top-right, top-left, and bottomright panels, respectively. These plots are not noticeably different from those in Fig. 12 for the MC noise model, indicating that the redistribution of odd correlated errors (due to the difference between models MC and PMC) and the measurement redefinition have little effect on the pseudo-thresholds.
The bottom-left panel of Fig. 14 plots the logical error for p 0 /p 2 = 2, 1, 1/2 with r = 1/10, q = 1/5, and p mst = 10 −4 . The x-axis, (4p 2 + p 0 )/5, is chosen for easy comparison to model MC but is no longer the average rate of creating an excitation (the probability some of the noise events in PMC on a measured island are independent of p 2 ). As expected, increasing p 2 worsens the logical error rate because it increases the relative distribution of correlated events, but it does so to a smaller degree than for MC since fewer of the noise events depend on p 2 .

Experimental Implications
The pseudo-threshold calculations in the previous section have important implications for experimental realizations of a tetron-based quantum computing architecture. In the limit of a hard superconducting gap and large charging energy, i.e., T min(∆, E C ), quasiparticle events are rare and the noise model PMC is a reasonable description of the mostlikely error sources in the system. The weak dependence of the pseudo-threshold on r in this regime indicates that once quasiparticle events are sufficiently rare and the relaxation time is less than one tenth of the four-MZM measurement time, it is not essential to further suppress the quasiparticle poisoning rate.
A second important experimental implication regards the tradeoff between correlated and measurement errors. Statistical errors in the measurement contribute to the probability p mst in our noise models. For the same length of measurement time, larger measurement visibility, which is controlled by the tunneling amplitude between the quantum dot and MZMs (see Section 3.1), results in smaller statistical error and hence smaller p mst . Conversely, the parameter q controlling the relative distribution of single-qubit and two-qubit errors increases with tunneling amplitude [see Eqs. (21), (22) and (26)]. Thus, we see a tradeoff in which reducing the tunneling amplitude can suppress correlated events at the expense of increasing measurement errors. However, the pseudo-threshold results indicate that, at least for Shor error correction of quantum memory, correlated events have a much stronger effect on the pseudo-threshold than do measurement bit-flips. Therefore, it is desirable to work with a smaller tunneling amplitude from the point of view of the pseudo-threshold. Reference [54] reached a similar conclusion about the relative importance of two-qubit errors compared to measurement errors for small-distance surface codes. The tradeoff of measurement and correlated errors is particularly interesting when also considering different error correcting codes that might provide certain advantages but introduce stronger correlated errors due to higher-weight measurements.
As noted earlier, the pseudo-threshold estimates in this paper prioritize simplicity of simulation over optimal magnitude, and should therefore not be interpreted as quantitative experimental targets. However, if the correlation parameter q can be reasonably estimated for a given system, then previous studies using the qubit-based model Pauli circuit noise are applicable. For instance, if q ∼ 1/15, then Ref. [55] suggests a pseudo-threshold for the d = 5 Bacon-Shor code O 10 −3 (with Steane error correction).

Extensions
We now discuss how the noise models can be modified to describe other Majorana-based systems. The physical error sources we considered (thermal excitation, extrinsic quasiparticle poisoning, fluctuations in the MZM hybridization energies, error in the measurements) are ubiquitous to all Majorana-based quantum computing architectures. Therefore, quasiparticle events, pair-wise dephasing events, and measurement bit-flips, as well as the corresponding probabilities p pair , and p (k) mst , respectively, should be present in any realistic stochastic Majorana noise model. The maximal number of MZMs involved in a parity measurement will vary depending on the proposal, therefore the allowed integer values of k will be system-dependent. Furthermore, the degree to which a particular proposal is susceptible to these errors will depend on experimental parameters of the system, including the size and gap of the superconducting islands, whether or not the island has a charging energy, and what potential quasiparticle reservoirs (e.g., metal or superconducting leads, quantum dots) are present.
The main assumption of all four Majorana noise models introduced in Section 2 regards the energy separation between even and odd parity states of the underlying quantum computing architecture. More specifically, we assume the system is divided into superconducting islands and that the environment relaxes islands with odd Majorana parity to the even parity subspace within a time step with high probability. When this is not the case, e.g., for grounded superconducting islands [56][57][58], step 0 of the Majorana noise models needs to be modified. In such systems, a single quasiparticle excitation can be long-lived, and multi-island stabilizer measurements can propagate the excitation throughout the system, see Appendix B.
Qubit-based error correcting codes are less effective in a MZM system with long-lived quasiparticle excitations. If the error correcting measurements introduce connected paths of islands spanning the system, a single quasiparticle excitation can cause a logical error within a time step. Therefore, in this scenario, the measurements must be carefully designed to minimize the spread of high-weight errors through quasiparticle excitations. Provided there is still a finite relaxation rate, the probability for an excitation not to relax over a full time step is exp {−1/r}. Thus, if measurements are designed so that excitations can only travel to neighboring islands in a time step 12 , the probability for a single excitation to travel through d (the code distance) islands (possibly resulting in a logical error) is exp {−(d − 1)/2r}. For d-large, this probability becomes vanishingly small and the qubit-based code retains some error correcting ability.
Alternatively, one could use a Majorana fermion code [24,34,35] to distinguish odd and even parity states, thereby correcting quasiparticle excitations before they can spread throughout the system. Such codes require the ability to either (1) measure the total parity of the MZMs on an island, or (2) dynamically adjust the number of MZMs on an island, both of which are experimentally challenging for the following reasons. (1) Proposals to date are not able to distinguish the total fermion parity of an island from the total parity associated with the MZMs. The measurements proposed in Refs. [56][57][58][59] measure the total charge on the island, and are thus unable to identify the presence of a thermally excited quasiparticle. Charge measurements of the islands are therefore helpful only if the charge excitations are long-lived while thermal excitations relax sufficiently fast.
(2) Dynamically adjusting the number of MZMs on an island requires sufficient tunability of certain experimental parameters (e.g., Josephson energy) to transition from the fully disconnected regime to the fully connected regime: residual coupling in the former can lead to increased probability of correlated events; non-fully connected regions within an island in the latter can result in mutual capacitances leading to higher weight errors, see Appendix A. Furthermore, the tuning procedure must be done sufficiently slowly and smoothly to avoid introducing diabatic errors into the system [60][61][62][63][64].
Model PMC was built on the further assumption of single or two-island quantum dot-based measurements involving at most two MZMs per island [40,41]. Additional correlated events can arise for alternate measurement schemes [32,35,[56][57][58] or if more than two islands are connected during a measurement. For instance, surface code implementations that rely on eight-MZM stabilizer measurements connecting four islands [15] could result in a correlated event involving any subset of the four islands.
Finally, the pseudo-threshold calculations in Section 4 are specific to Shor error correction of quantum memory for a system with four MZMs per island. The pseudo-threshold estimates would likely change for a Steane error correction analysis, if logical operations on the system are included, or if islands have more than four MZMs (e.g., a hexon architecture [41]). The benefit of the Bacon-Shor code is lost for Steane error correction, since the stabilizers could no longer be implemented from two-island measurements. Generally, for a stabilizer code, Steane error correction will estimate higher pseudo-thresholds, however we do not anticipate the change from Shor to Steane error correction to affect the 12 Note that the Bacon-Shor code already utilizes this clever design by only using two-qubit measurements. relative importance of quasiparticle and correlated events (r and q dependence). Including logical operations would probably result in a greater dependence on the relative magnitudes of p 0 , p 1 , and p 2 , as the majority of islands would no longer be involved in two-island measurements for each time step. With hexons (m = 3), the percentage of correlated events that do not commute with all stabilizer measurements is greater than for the case of tetrons; therefore we expect the pseudo-threshold to have a stronger q dependence. Furthermore, since physical considerations can constrain the number of allowed correlated events in PMC relative to MC, more substantial differences in the pseudo-threshold estimates are possible than were found for the tetron case considered here.

Conclusions and Outlook
The primary goal of this paper is to connect the underlying physical processes causing errors in a Majorana-based quantum computing architecture to the noise models used for fault tolerance analysis of the system. We developed stochastic Majorana noise models in close analogy to the standard qubit-based noise models generally used in threshold calculations. These Majorana noise models allow for errors involving an odd number of Majorana operators to occur, and have different probability distributions depending on whether a MZM island begins a time step in an even or odd parity state. The result of our analysis is that for quasiparticle-poisoning-protected qubits, the pseudothreshold estimate for the d = 5 Bacon-Shor code under each of the Majorana noise models is well-approximated by the estimate using the analogous qubit-based model. Essentially, when the relaxation parameter r 1/5, a quasiparticle event in one time step relaxes with high probability in the subsequent time step; the cumulative effect is to apply a Pauli error broken-up over two time steps, which does not dramatically alter the error correcting code's performance. This result does not depend on any particular feature of the Bacon-Shor code, thus we expect it to apply more generally to larger error correcting codes, as well as to error correction of logical gates. It is a positive result that MZM systems with short-lived quasiparticle excitations (e.g., charging-energyprotected qubits) can be analyzed with the simpler qubitbased noise models, as this simplifies numerical simulations and allows for studies of larger error-correction schemes.
Conversely, a MZM system with long-lived quasiparticles cannot be accurately described by a qubit-based noise model. In such a system, an excitation could travel between islands connected by measurements over several time steps with O(1) probability, thereby spreading throughout the system. In order to prevent excitations traveling long distances, it is therefore beneficial when performing measurements in parallel to avoid creating connected paths of islands span-ning the system. The Majorana noise models developed here could be extended to systems with long-lived excitations (see Appendix B). The latter make qubit-based codes less efficient and might require a Majorana fermion code for error correction [24,34,35] (see discussion in Section 5).
A useful observation is that in a Shor error correction scheme, in which stabilizer measurements are repeated to protect against a single measurement bit-flip, the error correcting code can sustain high probabilities of measurement errors without affecting the pseudo-threshold. This result applies equally well to conventional qubit systems. While generally Steane error correction results in higher pseudothresholds, if measurement error is a limiting obstacle, Shor error correction could be an attractive alternative.
Our pseudo-threshold analysis further demonstrates that there is a strong dependence on the relative distribution of single-island and correlated events. It is therefore essential that any realistic noise analysis of a given system carefully estimate the rate of transferring excitations between islands so as to choose an appropriate distribution of singleisland and correlated events. Furthermore, proposals involving higher-weight measurements (e.g., four-island stabilizer measurements in the surface code) will be subject to higherweight correlated events that could significantly affect the threshold estimate. The relative importance of correlated errors compared to measurement errors also indicates that it is worth optimizing the measurement processes so that correlated errors are suppressed even if this reduces the measurement fidelity.
This work is a first step towards comprehensive analysis of the fault tolerance of Majorana-based quantum computing architectures. Future directions of study include understanding to what extent our results hold for both larger error correcting codes and logical gate error correction. Additionally, an important open question is to determine the optimal error correction procedure for Majorana-based quantum computation. This analysis should weigh the experimental feasibility of the quantum error correcting codes under consideration (e.g., ability to perform stabilizer measurements and whether the underlying system needs to be charging-energyprotected) and the physical noise sources affecting the underlying architecture in addition to the usual fault tolerance criteria (e.g., threshold values and ratio of physical to logical qubits). We believe the connections elucidated here between physical error processes in MZM systems and noise models would aid in such an analysis. Figure 15: Decision tree for the generalized step 0 for models MC and PMC in the case of long-lived excitations. If an island involved in a k-island measurement begins in the odd parity state, it can either relax (left black line) with probability p odd , hop to another island involved in the measurement (center red line) with probability p hop , or remain excited throughout the time step (right blue line) with probability pstay. In the first or the last case, the noise model proceeds as described in the main text to allow for single island noise events, correlated events, or measurement bit-flips. In the latter case, if at least one of the islands involved in the measurement is still in the odd parity state, it again proceeds to the next step of the decision tree (relax, hop, or stay excited). Even for q k ∼ 1, the tree can be truncated after k 2 steps where all k island have been visited by the excitation. In the final step the excitation can then be assumed to either relax or stays excited. The probabilities for p odd and pstay are modified for the final step of the decision tree as shown.
timate the probability p

B Long-lived excitations
The Majorana noise models presented in Section 2 need to be modified when the system has long-lived excitations (e.g., in the case of islands with small charging energies) to include an additional type of correlated event: • Hopping event: application of two Majorana operators involving two islands connected by a measurement. A hopping event for islands i and j is of the form γ i,a γ j,b .
A hopping event can occcur when an island involved in a k-island measurement begins a time step in the odd parity state and transfers its excitation to another island involved in the same measurement. Such a process is more likely to occur when an excitation is long-lived. Models MC and PMC can be generalized to account for long-lived excitations by modifying step 0 as follows: 0. For the set of islands involved in the same k-island measurement, if at least one of the islands begins the time step with odd parity, do one of the following: (a) Apply a hopping event involving an odd parity island with probability p hop , and return to the beginning of step 0. (b) Apply a quasiparticle event to an island with odd parity with probability p odd , and proceed to step 1.
(c) Do not apply any noise events with probablity p stay = 1 − p hop − p odd , and proceed to step 1.
The generalized step 0 results in the decision tree depicted in Fig. 15. The chance for a large number n hop of hopping events is exponentially suppressed by q nhop k . Moreover, even for large q k ∼ 1, the tree can be truncated, with the final step modified to not include step 0a. For instance, if every island is only directly connected to at most two other islands (as in a tetron measurement), then a hopping event is a random walk through the connected path of islands. After k 2 steps, the average path includes the path involving all islands in the measurement; therefore all possible noise events occuring after k 2 +1 steps can be captured by a more-probable process in a smaller number of steps.
In the language of Section 3, the probabilities for the modified step 0 are given by (If truncating the modified step 0, the probabilities for the final step do not involve q k , see Fig. 15.) Recall that q k is the probability of an energy transfer between islands connected by a measurement, while r is the probability that an excitation occuring during a time step does not relax before the end of the time step. The probability that an island beginning a time step in the odd parity state does not relax is e −1/r . In the main text, we set p hop = 0. The justification for this approximation is that we assume r is small enough (quasiparticle excitations are short-lived enough) that noise events resulting from a sequence of hopping events are already captured by a sequence of correlated and single qubit noise events. More concretely, one might worry that not including hopping events neglects the possibility that a single excitation can result in a high-weight error spread over several time steps from a quasiparticle traveling between different islands connected by subsequent measurements. Consider, for instance, the following two scenarios leading to a weightthree error: (1) An idle island is initially excited in the first time step, the excitation is transferred to a second island in the second time step and does not relax, and the excitation is transferred to a third island in the third time step and then relaxes. This process applies a pair of Majorana operators on all three islands involved. In an alternative scenario (2) an idle island experiences no noise events in the first time step, the first and second islands are involved in an even correlated error in the second time step, and the third island undergoes a pair-wise dephasing event in the third time step. Process (1) only requires a single excitations to cause a weight-three error, while process (2) is the most probable implementation of a weight-three error over three time steps that does not involve hopping events. Process (1) occurs with probability p qp (p hop p stay ) (p hop p odd ) (44) and process (2) occurs with probability cor,even p (2) pair .
(We assume the first island is idle in the first time step for simplicity, the argument naturally extends if the island is instead involved in a measurement.) Processes (1) and (2) result in the same computational effect for the MC simulation discussed in Section 4.4, because the net application of Majorana operators at the end of the third time step are equivalent for (1) and (2), and intermediate steps are interpreted as measurement errors. We are therefore justified in neglecting process (1) when the probability (44) is much less than (45). This is the case provided The simplifying approximation holds for small q and r. For q = 1/5 and p 0 = 10 −3 condition (46) is valid provided r < 1/5, and for q = 1/5 and p 0 = 10 −4 is valid provided r = 1/7. Note that the r values in Fig. 12 were chosen to exagerate the r dependence of the noise model and do not strictly fall into this regime. Including additional time steps does not result in a stronger condition on the relative size of p 0 and r. When r is too large to satisfy Eq. (46), we need to use the more complicated step 0. In this regime, a single excitation can result in a high-weight error by continually spreading to new islands with each multi-island measurement.
In scenarios with long-lived excitations it becomes crucial to devise a careful measurement protocol to avoid introducing paths of connected islands spanning the system. If errors can only hop to O(k) nearby islands in a single time step, an excitation will eventually relax before traversing the system if the system size becomes sufficiently large. This implies that, while being less efficient, large qubit-based codes will still be able to correct for long-lived excitations. At some Finally, if the quantum computing architecture is built from grounded superconducting islands, an island can spend an equal amount of time in the even and odd parity states. In this case, the probabilities of different noise events are the same regardless of in which parity state the system begins. In this regime, excitations are dominated by extrinsic quasiparticle poisoning events and Eq. (24) is modified to In particular, p k is no longer exponentially suppressed and all noise events become much more likely.

C Pseudo-threshold code
In this appendix, we give further details of the code used to simulate the pseudo-thresholds reported in the main text Section 4.

Perfect measurement Monte Carlo algorithm:
In both the qubit-based model Pauli noise and the Majorana model Qp, the measurements are perfect and the algorithm to model error correction is as in Algorithm 1.
The algorithm estimates p err by sampling simulated trials of faulty quantum error correction and counting the fraction of trials which result in a logical error. In each trial, errors occur according to the noise model (for a given set of noise parameters), and are recorded in a binary vector 'err' of length 100 = 4 × 25, i.e., one for each MZM. A bit value of 1 indicates that the corresponding Majorana operator was applied to the system, otherwise the bit value is 0. This error is added bitwise to the length 100 binary vector 'MList' (initially trivial), which tracks the net set of Majorana operators which have been applied to the system. After the noise has been applied, the gauge measurement outcomes are inferred, in practice by storing each gauge operator as a row of a binary array 'gaugeMatrix' (with a bit value of 1 for each Majorana operator appearing in the gauge operator), and multiplying it by 'MList'. The results are stored as a binary vector 'gaugeOutcome'. The stabilizers 'stabOutcome' are found by multiplying the appropriate subset of gauge measurement outcomes and a correction 'corr' is inferred from a lookup table for the Bacon-Shor code, which would apply the appropriate Pauli correction for two or fewer single qubit Pauli errors (again encoded in a bit string) as described in Section 4.2. The final result of the error correction attempt is obtained by adding 'corr' to 'MList'. If the error correction was successful 'MList' is a binary representation of a trivial operator. This is checked by taking a binary dot product of the list of all possible non-trivial logical operators 'logicalMatrix' with 'MList' which yields 0 (1) when 'MList' shares an even (odd) number of Majorana operators with a certain logical operator and thus (anti)commutes. Anticommutation with any local operator is then counted as a failure. In our simulations, the number of samples used to generate each data point was N = 10 5 .

Importance sampling with perfect measurement:
The above Monte Carlo procedure would become slow for small error rates, since the number of repetitions becomes very large, requiring huge computational resources. This is largely because, for very low error rates, almost every run has only zero or one faults. In practice, the error rates required for our purposes were sufficiently large for Pauli noise and the Majorana model Qp to allow us to use Monte Carlo, but it is useful to describe this case for illustrative purposes. Since the protocol is fault tolerant (as proven in Appendix D), zero or one faults will never cause a logical failure. Therefore, we can save time by only generating samples in which at least two faults occur. In order to do this, we must be able to both calculate the probability that at least one fault occurs, and efficiently sample from the distribution formed by post selecting on there being at least one fault. This procedure is known as importance sampling. Here, we can apply importance sampling relatively simply by considering each tetron independently, and by separately considering errors on all subsets of v tetrons, for v = 2, 3, 4 . . . . We can truncate v at v trunc when the probability of v trunc tetrons having an error becomes negligible.
Let W be the set of all tetrons, and let Pr(v) be the probability of precisely v of the tetrons having an error. Then, the importance sampling Monte Carlo algorithm is implemented as in Algorithm 2. In each run, a subset w containing v tetrons is randomly selected; noise is drawn from the post-selected distribution where errors occur on each tetron in the subset w and nowhere else.

Imperfect measurement Monte Carlo algorithm:
We now consider the noise models for which the measurements can be imperfect (i.e., QpBf, MC, PMC, and their analogous qubit-based models). For these models, our quantum error correction protocol repeats measurements four times to achieve fault-tolerance, essentially by increasing the reliability of the inferred stabilizer outcomes. Algorithm 3 therefore includes four error correction rounds t, and the correction protocol is implemented as normal, but by using the last repeated set of stabilizer outcomes (or the last stabilizer outcome if none are repeated). We also apply an additional round of perfect error correction to ensure that the system is returned to the code space.
We have used S to represent the number of stabilizer generators. The function 'Noise[MList]' here is very general -in the MC noise model for example, it actually entails a sequence of four time steps, during each of which a different set of gauge generators is (noisily) measured.

Importance sampling with imperfect measurement:
A key feature of the importance sampling in the perfect measurement case described above is that each possible fault is independent. However, now that we have multiple time steps, and since in some of our noise models, the noise can depend on the current state of the system, we can no longer treat the faults as being independent. Moreover, importance sampling really is necessary for these cases since the error rates in the region of interest are very small rendering Monte Carlo extremely time consuming. The number of samples that would be needed for the regime of interest for MC and PMC would require extremely large sample numbers without any kind of importance sampling. Fortunately, we can implement a partial importance sampling: we run importance sampling for the first fault that occurs, and then after that we run the system forward in time with usual Monte Carlo. The algorithm is a straightforward combination of Algorithms 2 and 3. The effective number of total samples used per data point for imperfect measurements was 10 7 for the plots in which p mst was varied, and and 10 8 samples for the rest of the simulations (although many of these were not actually run due to the importance sampling step). Table 3 we explicitly write the eight computationally distinct bit strings for a single island and the corresponding probability of applying that bit string to 'MList' in a time step. This table is used to generate single-island error strings in models Qp, QpBf, and MC. For the jth tetron, the bit string (1, 0, 1, 0) corresponds to γ j,1 γ j,3 , or equivalently to γ j,2 γ j,4 (because the total parity of an island is fixed). For simplicity, we write the probabilities for models Qp and QpBf. Model MC is straightforwardly generalized by adding the appropriate superscript to each of the probabilities: (0) for an idle island or (k) for a k-island measurement. Model PMC is slightly more complicated for a measured island as we need to distinguish which MZMs are being measured. Note that since the parity of a tetron is fixed, bit strings that differ by (1, 1, 1, 1) are computationally equivalent. Models MC and PMC will additionally have two-island errors, whose probabilities depend on p cor,even and p cor,odd .

D Fault tolerant conditions
In this appendix, we detail how fault tolerance conditions (EC A)-(EC B) are satisfied for noise models Qp, QpBf, MC, and PMC.
Qp: We simulate model Qp with a noisy time step followed by perfect application of all stabilizer measurements followed. Measurements are defined according to Eq. (36). We use the minimum weight perfect matching decoder for the resulting syndrome to choose which correction operator to apply.
Model Qp assumes perfect measurements, thus (EC A) and (EC A') are automatically satisfied. To check that (EC B) holds, we know that the d = 5 Bacon-Shor code can correct all single-and two-qubit Pauli errors, and that in a tetron system all pair-wise dephasing events can be expressed as Pauli errors. Therefore, we just need to check that quasiparticle errrors are similarly correctable. A single fault corresponds to either a quasiparticle excitation in one time step followed by relaxation in the next time step, or a pair-wise dephasing event. The former process has the same net effect as the latter, and is thus correctable. To see this more explicitly, consider the sequence of the quasiparticle event γ j,a occuring in one time step and the island relaxing back to the even parity subspace in the subsequent time step with application of γ j,b . The first error has the same syndrome as the Pauli error γ j,a γ j,4 (because γ j,4 is not involved in any of the stabilizer measurements), thus the error correction will inadvertently apply the operator γ j,4 . The net operator applied to the island at the end of the next time step is γ j,b γ j,4 , which is simply a Pauli error. More generally, once the island has returned to the even parity subspace, the net operator applied to the island is a Pauli error, which can be corrected in the standard way. Intermediate corrections (while the island remains in the odd parity subspace) do not worsen the error.
QpBf: Model QpBf is simulated with a noisy time step followed by application of all stabilizer measurements, repeated four times (i.e., one time step per error correction round). Measurements are defined according to Eq. (36). We apply the minimum weight perfect matching decoder to the last syndrome to be repeated. If no syndrome is repeated, we select the last syndrome.
To check that conditions (EC A) and (EC A') hold, first consider a single measurement bit-flip occuring, which flips one of the four syndromes. Our protocol ensures that we select the correct syndrome, thus we correctly ignore the mea- Table 3: The eight computationally distinct single-island bit strings (left column) and their corresponding probabilities when the island begins the time step with even parity (middle column) and odd parity (right column). The probabilities are written for models Qp and QpBf, but are easily generalized to MC by including the superscript (k) when the island in question is involved in a k-island measurement. The first row corresponds to no error, the second row to errors involving an odd number of MZMs, and the last row to errors involving two MZMs. surement bit-flip. Now, suppose a pair-wise dephasing event occurs in the first, second, or third time step. The third and fourth syndromes will then agree, and correctly reflect the error applied to the system, thus the error correction step at the end of the protocol will return the system to the error-free code state. If the pair-wise dephasing event occurs in the fourth time step, we will select the syndrome indicating no error has occurred: this will neither correct nor worsen the error, so that in the subsequent error correction round the error can be corrected. Finally, a quasiparticle event followed by a relaxation has the net effect of applying a Pauli operator and is thus correctable (either in the same error correction round or the subsequent round depending during which time step the initial excitation occurs); the intermediate syndrome will be interpreted as a measurement error and thus does not worsen the error.
For condition (EC B), we need to show that any two faults occuring within an error correction round can be corrected either in the same error correction round or in the next. If neither of the faults are measurement bit-flips, then they are correctable for the same reasons given for model Qp (although possibly not until the next error correction round if they occur in the fourth time step). If only one fault is a measurement bit-flip, it will not appear in the selected syndrome and will not affect the correction protocol, and the remaining fault is correctable for the same reasons given in Qp. Finally, if both faults are measurement bit-flips, they will only affect the correction protocol if they result in the same syndrome in the second and third, or the third and fourth measurement repetitions. The correction step will then at most apply two Pauli operators to the system, which can be corrected in the subsequent error correction round if no additional faults occur.

MC:
Model MC is simulated with the error correction round shown in Fig. 9, with a noisy time step preceding each stabilizer measurement. The entire error correction round is then repeated four times (total of 16 time steps). Measurements are defined according to Eq. (36). We apply the minimum weight perfect matching decoder to the last syndrome to be repeated. If no syndrome is repeated, we select the last syn-drome. We use the d = 5 Bacon-Shor code as a d = 3 code when including correlated events.
Conditions (EC A)-(EC B) are satisfied for the same reasons given for QpBf. Even correlated events map to two-qubit Pauli errors and can thus be corrected for the same reasons as in the qubit system. Odd correlated events γ i,a γ i,b γ j,c result in the same syndrome as the even correlated event γ i,a γ i,b γ j,c γ j,4 , with i = j. After relaxation back to the even parity subspace, the net Majorana operator string applied to islands i and j is equivalent to a two-qubit Pauli operator applied in a single time step. Because there are more time steps for each error correction round, it is even less likely for measurement bit-flips to be repeated in a way that affects the accepted error syndrome.
PMC: Model PMC is simulated according to the same protocol as MC, with the only difference being that measurements are now defined according to Eqs. (39) and (40).
The fault tolerance conditions (EC A)-(EC B) are satisfied for the same reasons given in the other noise models, with only a slight modification. Here, for all non-corner islands, every MZM on the island is involved in some stabilizer measurement, and the syndrome corresponding to a quasiparticle event on that island will match the syndrome corresponding to multiple pair-wise dephasing events. However, once the island relaxes back to the even parity ground state, the net operator applied to the island will be equivalent to a Pauli operator. Thus, the syndrome will change, and the intermediate step at which the island was excited will be interpreted as a measurement bit-flip.