Quantum repeaters based on concatenated bosonic and discrete-variable quantum codes

Abstract

We propose an architecture of quantum-error-correction-based quantum repeaters that combines techniques used in discrete- and continuous-variable quantum information. Specifically, we propose to encode the transmitted qubits in a concatenated code consisting of two levels. On the first level we use a continuous-variable GKP code encoding the qubit in a single bosonic mode. On the second level we use a small discrete-variable code. Such an architecture has two important features. Firstly, errors on each of the two levels are corrected in repeaters of two different types. This enables for achieving performance needed in practical scenarios with a reduced cost with respect to an architecture for which all repeaters are the same. Secondly, the use of continuous-variable GKP code on the lower level generates additional analog information which enhances the error-correcting capabilities of the second-level code such that long-distance communication becomes possible with encodings consisting of only four or seven optical modes.

Introduction

Quantum cryptographic and quantum computing tasks offer qualitative advantages over their classical counterparts. However, in order to implement these tasks, it is essential to be able to transmit quantum information across long distances. There have been significant efforts in recent years in designing future large-scale quantum networks, that could offer such a functionality by overcoming the exponential signal decay with distance in the optical fibre through the use of quantum repeaters^1,2. Multiple different types of quantum repeaters have been proposed, utilising different techniques to overcome losses and operational errors of the devices.

The original repeater proposals utilise heralded entanglement generation between repeater stations^1,2. These elementary links can then be connected into end-to-end entanglement using Bell-measurements at the repeaters. The entanglement rate of these schemes is significantly limited by the communication time between repeaters, where the communication is needed to herald success of both elementary link generation and probabilistic entanglement distillation used for correcting operational errors. These limitations can be overcome using one-way quantum repeaters based on forward error correction^{2,3,4,5,6,7,8,9,10,11,12}. Such repeaters are not limited by two-way communication, as a stream of qubits, encoded in a loss-tolerant code, is sent over a multi-hop channel. A repeater station uses quantum decoding and re-encoding operations to near-deterministically correct errors (loss and operational) and forwards the encoded state to the next station. Most of the repeater schemes belonging to the above two categories need quantum memories, which could be substituted by all-photonic entangled states^13,14. However, there also exist one-way schemes which do not require any storage of quantum information, and where all the operations performed inside the repeaters involve only optical elements^7,11. Yet, the use of a few matter qubits in such repeaters could enable for more efficient generation and error correction of the photonic encoded states¹².

The significant rate improvement of these error-correction-based schemes comes at the cost of large physical resource overhead. Specifically, in order to overcome losses over a 1000 km path, most one-way and all-photonic architectures would require the ability to generate, transfer, store, and operate on hundreds or thousands of highly entangled qubits within each repeater^{4,7,11,12,13,14}.

So far, all existing one-way quantum repeaters only considered quantum error correction based on two-level or multi-level encoding to correct excitation loss errors, without taking advantage of the bosonic nature of the quantum channel. Here, we propose a new type of quantum repeater architecture based on concatenated quantum error correction, with continuous-variable (CV) bosonic encoding at the lower level (inner code) and discrete-variable (DV) encoding at the higher level (outer code). The specific bosonic code that we consider here is the single-mode Gottesman–Kitaev–Preskill (GKP) code¹⁵, which has been demonstrated to perform well against photon loss errors given a suitable encoding strategy^16,17. We note that while implementation of GKP encodings is challenging, there have been experimental demonstrations of approximate GKP states in trapped ions^18,19 and the superconducting microwave cavity²⁰. While various architectures for quantum computing based on GKP encodings have been proposed^{21,22,23,24,25,26}, no corresponding quantum communication protocol has yet been considered. Similarly as in the proposed quantum computing architectures with GKP code, we propose to concatenate the GKP code with a higher-level multi-qubit code to boost its performance. We show here that if sufficiently high-quality GKP states can be prepared and operated on, then long-distance quantum communication can be achieved by using only few qubits in the higher-level multi-qubit encoding. Moreover, our repeater architecture is also cost-efficient. This is because we find that in order to maintain high performance it is not necessary for all quantum repeaters to be able to perform error correction on both encoding levels. Specifically, it is sufficient for the more powerful but at the same time more costly repeaters correcting errors on both levels to be placed only sporadically, with majority of repeaters correcting only the lower-level errors as shown in Fig. 1. This enables significant reduction of the required resources as the repeaters correcting only the lower-level errors need to operate only on single GKP data modes at a time.

Fig. 1: The proposed hybrid concatenated-coded repeater architecture.

a The Wigner function of the single-mode imperfect GKP state is depicted in the enlarged inset. We propose to use two levels of encoding and on the second level multiple single-mode GKP qubits are entangled together (marked with an orange ribbon) to encode a single logical qubit. The repeater architecture makes use of two types of repeaters. The first type are type-B repeaters (marked as blue), which can correct small displacement errors on the single GKP qubits that are sequentially transmitted between those stations. A displacement larger than the critical value cannot be corrected by the type-B repeaters and results in a logical error at the GKP level after the GKP correction (marked by the red GKP qubit). Therefore we sporadically introduce more powerful (and costly) type-A repeaters (marked as green) which store all the subsequently arriving GKP qubits from a given second-level-encoded block. By jointly operating on all such qubits, the type-A repeaters can efficiently correct logical errors from the failed GKP corrections at the lower level. b High-level depiction of the operations performed in each repeater type. Type-B repeater corrects small random displacement errors in both $\hat{q}$ and $\hat{p}$ quadratures by measuring the stabilisers of the GKP code. Type-A repeater additionally corrects higher-level X and Z errors corresponding to the logical errors on the GKP level. These errors are corrected by measuring the Z and X stabilisers of the outer code. A detailed description of these operations for the type-B repeaters is provided in Supplementary Note 5 and for the type-A repeaters in Supplementary Note 7.

Results

GKP repeater chain architecture

In this section, we describe a simple repeater architecture in which quantum information is encoded in the GKP code and the GKP repeaters placed along the channel are used to correct errors arising from the communication through a lossy channel. We will see that GKP encoding alone together with a specific considered decoding strategy is not sufficient to achieve long-distance quantum communication, which motivates the introduction of the concatenated-coded scheme, described in “Repeater architecture based on concatenated GKP and discrete-variable codes” section. Firstly however, we provide some basic information about the fundamental principles behind the GKP error correction.

GKP-qubit error correction

Similarly to quadrature amplitude modulation encoding used in classical communication²⁷, we may use the quantum GKP encoding to correct loss errors. The basic idea behind the GKP code¹⁵ is that while the exact value of two conjugate continuous observables $\hat{q}$ and $\hat{p}$ cannot be measured simultaneously, the two operators

$${\hat{S}}_{{\rm{q}}}=\exp (i2\sqrt{\pi }\hat{q}),\quad \quad {\hat{S}}_{{\rm{p}}}=\exp (-i2\sqrt{\pi }\hat{p}),$$

(1)

which are periodic functions of $\hat{q}$ and $\hat{p}$, commute with each other and therefore can be measured simultaneously. The GKP code thus encodes a qubit in a two-dimensional subspace of an infinite-dimensional oscillator space. This subspace is stabilised by these two operators and the GKP state can be visualised as an infinite, periodic grid structure in the (q, p) phase space. For the GKP code based on a square lattice, which we will consider here, the standard basis states are given as:

$$\begin{array}{l}\left|{0}_{\text{GKP}}\right\rangle =\mathop{\sum}\limits_{n\in {\mathbb{Z}}}\left|q=2n\sqrt{\pi }\right\rangle ,\\ \left|{1}_{\text{GKP}}\right\rangle =\mathop{\sum}\limits_{n\in {\mathbb{Z}}}\left|q=(2n+1)\sqrt{\pi }\right\rangle .\end{array}$$

(2)

Similarly the GKP X basis logical states are:

$$\begin{array}{l}\left|{+}_{\text{GKP}}\right\rangle =\mathop{\sum}\limits_{n\in {\mathbb{Z}}}\left|p=2n\sqrt{\pi }\right\rangle ,\\ \left|{-}_{\text{GKP}}\right\rangle =\mathop{\sum}\limits_{n\in {\mathbb{Z}}}\left|p=(2n+1)\sqrt{\pi }\right\rangle .\end{array}$$

(3)

We can see that the grid corresponding to the basis state $\left|0\right\rangle$ ($\left|+\right\rangle$) is shifted by $\sqrt{\pi }$ along the $\hat{q}$ ($\hat{p}$) quadrature with respect to $\left|1\right\rangle$ ($\left|-\right\rangle$). Hence, by measuring the two stabilisers, which amounts to measuring both $\hat{q}$ and $\hat{p}$ quadratures of the GKP state modulo $\sqrt{\pi }$, we can detect and correct any small shifts (of size smaller than $\sqrt{\pi }/2$) in both quadratures, in a way that does not reveal the encoded logical information.

The two GKP stabilisers can in fact be measured using additional GKP ancilla modes through a Steane error-correction process. Application of a two-mode operation between the GKP data mode and the GKP ancilla can transfer the information about the noise from the data qubit onto the ancilla in such a way that the logical information is not revealed. Hence, measuring the ancilla and applying a feedback displacement based on the measurement outcome enables GKP quantum error correction. More detailed information about this procedure can be found in Supplementary Note 1.

We note here that an ideal GKP state corresponds to a superposition of infinitely many infinitely squeezed states hence requiring infinite energy. Such states are unphysical and realistic GKP states have finite amount of squeezing, see “Realistic GKP states” section. This means that the information obtained from the measurement on the GKP ancilla is effectively noisy and therefore the feedback displacement will not bring the data state exactly to the logical space, but will leave some residual displacement reflecting the finite amount of squeezing of the GKP ancilla. Here, we consider a specific strategy of rescaling the measured GKP syndrome by a real number c ∈ (0, 1] before applying the feedback displacement^24,28,29. The value of c depends on the relation between the channel noise and the amount of GKP squeezing and is chosen such that the variance of the residual displacement after the feedback correction can be minimised, see Supplementary Note 2 for details.

In practice, communication channels are corrupted by loss, not a shift in phase space. Nevertheless, it is known that the GKP code also works well against loss errors. This is because the sender can phase-insensitively amplify the GKP states (with a gain determined by the expected loss) such that the action of the effective channel results in random shift errors, which the GKP code is designed to correct for^17,30,31,32. This strategy is described in more detail in Supplementary Note 3.

Repeater model

In the considered architecture quantum information encoded in the GKP qubits is sent through the repeater chain as follows. After Alice performs the encoding operation, she applies the phase-insensitive amplification and sends the GKP qubit through the lossy channel towards the first GKP repeater. The repeater performs GKP correction first in $\hat{q}$ and then in $\hat{p}$ quadrature. After that it again applies the phase-insensitive amplification and sends the state to the next repeater. In this way the encoded qubit can effectively be transmitted to Bob. In our model, we consider two sources of imperfections apart from loss in the communication channel. Firstly, we assume a finite photon in-coupling and out-coupling efficiency η₀, which quantifies the efficiency of transferring the photon from the fibre to the repeater and back into the fibre. Hence, the total transmissivity of the lossy channel between two neighbouring repeaters separated by the distance L is:

$$\eta ={\eta }_{0}{e}^{-L/{L}_{0}},$$

(4)

where L₀ is the attenuation length of the channel. Here we assume transmission at telecom frequency at which L₀ = 22 km. The second imperfection we consider is the finite amount of GKP squeezing. Under finite squeezing the GKP grid does not consist of delta functions but of Gaussian peaks with an overlaying envelope function, such that the peaks in the Wigner function decay to zero height in the limit of large quadrature values. The standard deviation of these finitely squeezed Gaussian peaks is given by σ_GKP, and the amount of squeezing can also be quantified by comparing σ_GKP to the standard deviation of a Gaussian peak of a coherent state given by $1/\sqrt{2}$. Hence squeezing expressed in dB can be defined as:

$$s=-10\,{{\rm{log}}}_{10}(2{\sigma }_{\,\text{GKP}\,}^{2}).$$

(5)

In our analysis, similarly to²⁶, we consider a conservative error model which allows us to describe a finitely squeezed GKP qubit as an ideal GKP state subjected to a random displacement according to a probability distribution parameterised by σ_GKP, see “Realistic GKP states” section for details. Since both finite GKP squeezing and the channel noise lead now to random displacement errors, we can reliably approximate the repeater performance by considering perfect error correction using infinitely squeezed ancillas, which however is now performed on the data qubits subjected to an effective communication channel. This effective channel now includes not only the noise coming from η defined in Eq. (4) but also from non-zero σ_GKP. That is we consider an approximation in which the noise from finite squeezing can be effectively incorporated into the channel, and combined with the noise due to photon loss. This approximation enables us to construct a simple analytical model through which we can efficiently evaluate repeater performance, including optimisation over repeater spacing. We validate this analytical model against a numerical Monte-Carlo simulation, see Supplementary Notes 4 and 5 for more information about the model.

Performance of the GKP repeater chain

We quantify the performance of our scheme by calculating the achievable secret-key rate in bits per optical mode $r^{\prime}$. This is a fundamental information-theoretic quantity that plays a key role in the studies of quantum communication^33,34, and the units of bits per mode are also often referred to as bits per channel use or bits per channel use per mode. We consider a six-state quantum key distribution (QKD) protocol³⁵ supplemented with the two-way post-processing scheme called advantage distillation³⁶. This scheme enables Alice and Bob to filter out a large fraction of erroneous rounds thus significantly increasing the achievable key rate in the high-noise regime. Specifically, we consider the advantage distillation protocol of³⁷ which for all noise regimes allows us to generate more key than with standard one-way post-processing. Moreover, since in the GKP error correction we independently correct errors in the $\hat{q}$ and $\hat{p}$ quadratures, the probability of a Y flip is quadratically suppressed. This is because a logical Y-error can only happen if there is both a logical X and Z error. This asymmetry leads to the fact that the quantum bit error rate (QBER) will be much larger in the Y basis than in the X and Z basis. Therefore, we can make use of the result of³⁸ where it is shown that if advantage distillation is used, we will obtain the highest secret-key rate by using the basis with the highest QBER for key generation. See Supplementary Note 8 for more details on the discussed QKD protocol and Supplementary Note 5 for details on evaluating QBER for the GKP repeater chain.

We list the results in the top left table in Fig. 3. Specifically, we list the achievable distances over which secret-key rate in bits per optical mode stays above $r^{\prime} =0.01$. We choose this specific value as a threshold as it allows us for an easy comparison of our scheme with the PLOB bound³⁴, which corresponds to the two-way assisted capacity of the pure-loss channel. This quantity describes the ultimate limit of repeater-less quantum communication. For perfect devices and as a function of the communication distance L_tot it is given by $K({L}_{\text{tot}})=-{{\rm{log}}}_{2}(1-\exp (-{L}_{\text{tot}}/{L}_{0}))$. While it drops below K(L_tot) = 0.01 after L_tot = 109 km, it stays positive for all distances L_tot. However, the amount of key that can be generated through such direct transmission becomes negligible for large distances. On the other hand, the secret-key rate of our repeater schemes starts dropping rapidly to zero at certain distance L_tot such that the distance at which its value is given by $r^{\prime} =0.01$ is close to the distance at which it falls to zero. This is due to the fact that the effective channel modelling the transmission through our repeater schemes is the Pauli channel, see “Monte-Carlo simulation” section and Supplementary Note 8. These features can also be seen in Fig. 5 for our concatenated-coded schemes. Hence, the threshold value of 0.01 provides a good reference that allows us to investigate the communication distances for which the amount of generated key is non-negligible.

For each set of parameters we optimise the repeater separation such that the generated secret-key rate can be maximised, with the restriction that the minimum repeater separation is 250 m. We find that for all the parameter configurations, for which the achievable distance is larger than 100 km, the optimal repeater spacing that maximises secret-key rate at that achievable distance is always the minimum separation of 250 m. The main conclusion drawn from the obtained data is that in order to achieve communication over distances of 1000 km and larger, close to perfect photon coupling efficiency is needed with unrealistically high amount of GKP squeezing. This means that for the GKP encoding/decoding strategy based on phase-insensitive amplification, GKP code alone is not sufficient for achieving practical long-distance quantum communication. This motivates us to introduce the second level of encoding.

Repeater architecture based on concatenated GKP and discrete-variable codes

Random displacements with components along the q and p axes that are larger in magnitude than $\sqrt{\pi }/2$ are not correctable by the GKP code alone. Therefore we consider a second level of encoding, either with a [[4,1,2]] code³⁹ that encodes one logical qubit in four modes (i.e., four GKP qubits) or with [[7,1,3]] Steane code⁴⁰, which encodes one logical qubit in seven modes (i.e., seven GKP qubits). This higher-level encoding enables us to correct logical GKP errors and hence effectively to correct displacements with magnitude larger than $\sqrt{\pi }/2$.

Concatenated-coded repeater architecture

We consider a hybrid repeater architecture in a linear chain, with N type-A (outer code) repeater nodes and mN type-B (inner code) repeater nodes (where m is an integer we optimise) such that there are m type-B nodes (also referred to as GKP nodes) between consecutive type-A nodes (also referred to as multi-qubit nodes). Distance between consecutive repeater nodes (regardless of their type) is taken to be a constant we optimise. A type-A node waits to receive 4 (7) modes—of a 4-GKP-qubit-encoded (7-GKP-qubit-encoded) single logical qubit in a [[4,1,2]] code ([[7,1,3]] Steane code), corrupted by noise—performs a GKP error correction described in “GKP repeater chain architecture” section on all the modes followed by the outer-code error correction, and transmits in sequence the 4 (7) GKP modes of the 4-mode-entangled (7-mode-entangled) state to the next hop (a type-B node). A type-B node simply applies GKP error correction as in the GKP repeater chain to each received mode, and sends it to the next node (which could be type-A or type-B).

We note that in order to maximise repeater performance, repeater architecture utilising only the more powerful type-A nodes would in most cases be sufficient. However, this would necessitate a dense placement of these multi-qubit nodes, which require more quantum memory and processing, and are more resource expensive than type-B nodes. Therefore we will show that in order to optimise the performance-cost trade-off, it is beneficial to consider the hybrid architecture consisting of both types of nodes. We depict our repeater architecture in Fig. 1. Further details of our concatenated-coded repeater scheme are described in Supplementary Notes 6 and 7.

GKP analogue information

The feature of our repeater scheme that enables us to significantly boost its performance with respect to other one-way repeater architectures based on error correction, is the use of analogue continuous information from the GKP corrections at both type-B and type-A nodes in order to enhance the correcting capabilities of the outer code⁴¹. Specifically, measuring the GKP syndrome amounts to measuring each of the quadratures modulo $\sqrt{\pi }$, such that the syndrome is a number from a continuous interval $[-\sqrt{\pi }/2,\sqrt{\pi }/2)$. If the measured value is close to the boundary of this interval, there is a higher probability that the correction back to the logical GKP space will result in a logical error. This observation can be made mathematically rigorous, that is for a given measured syndrome value an error likelihood during correction can be established. This additional syndrome information, when passed from the type-B GKP repeater nodes to the type-A (multi-qubit) repeater nodes, enables the latter to correct more errors that are otherwise not correctable by the [[4,1,2]] and [[7,1,3]] codes. Specifically, for Pauli errors the [[4,1,2]] outer code is only an error-detection code that cannot correct any errors while the [[7,1,3]] outer code can normally correct only single-qubit errors. However, as shown in ref. ⁴¹, by utilising the continuous GKP syndrome information the [[4,1,2]] outer code can be transformed into an error-correction code, which can correct most of single-qubit errors. We also find that with the analogue information the [[7,1,3]] outer code can correct most of both single-qubit and two-qubit errors. See Supplementary Notes 1, 6, and 7 for mathematical details on calculating error likelihood from the analogue information for our schemes.

We illustrate the benefit of the analogue GKP information in Fig. 2, where we consider a simple scenario in which Alice performs perfect encoding, applies phase-insensitive amplification to all the GKP qubits and then transmits the encoded state through the pure-loss channel with photon loss probability γ = 1 − η. Bob then firstly performs a round of perfect (i.e., using infinitely squeezed ancilla modes) GKP correction on all the GKP qubits followed by the perfect outer-code correction. We then plot the maximum infidelity versus the loss probability γ for the single-mode GKP encoding and the two-level-coded scheme. The maximum infidelity is given by one minus fidelity between the input state of Alice and the output state after transmission and correction of Bob. The specific input state is the state that minimises the fidelity or equivalently maximises the infidelity, see Supplementary Note 9 for more details. For the case when the [[7,1,3]] outer code is used, we plot separately the scenarios in which we do and do not make use of the additional analogue information from the GKP correction round. We see that making use of this information provides a significant performance boost for our two-level-coded scheme. We also see that the concatenated-coded schemes improve the performance with respect to just GKP encoding. Furthermore, we see that for low loss, if we use the [[7,1,3]] outer code but do not make use of the analogue information, the performance becomes similar to that of the scheme based on the [[4,1,2]] outer code, as both architectures can then correct only single-qubit errors. For larger losses the scheme based on the [[4,1,2]] outer code performs even better, because less qubits are used resulting in a smaller probability of an uncorrectable two-qubit error after GKP correction. The fact that these two schemes achieve a similar performance further justifies the capability of the analogue information to transform the error-detecting code into an error-correcting code originally observed in ref. ⁴¹.

Fig. 2: Maximum infidelity (maximised over all input states) versus photon loss probability γ for the different considered encoding schemes.

We consider a scenario where Alice performs the encoding and sends the state to Bob, who performs error correction. For all plotted schemes apart from the “only [[4,1,2]]” scheme it is the GKP error correction, followed by the second-level error correction for the concatenated-coded schemes. We assume correction using infinitely squeezed ancilla modes, so that after correction the state will be in the code space, either with errors corrected or with a logical error. Additionally, we plot the maximum infidelity of 5γ² for the purely discrete-variable scheme based on the [[4,1,2]] code (dotted green) as proposed in ref. ⁴². The curves for all the schemes apart from the “only [[4,1,2]]” scenario have been obtained from the simulated data and the relative error on the maximum infidelity is around 7% for all the data points, see “Monte-Carlo simulation” section for details.

Additionally we also compare the performance of our GKP-based schemes with a purely discrete-variable qubit scheme based on the [[4,1,2]] code⁴². Specifically, it has been shown that while this code is only an error-detection code against Pauli errors, it can be used for approximate error correction against a qubit amplitude damping channel, which corresponds to the pure-loss channel restricted to the vacuum and single-photon subspace. We see in Fig. 2 that making use of the full infinite-dimensional space with the GKP-based encodings that convert the action of the pure-loss channel into a random displacement channel allows for better performance than using only a qubit space of four optical modes against the amplitude damping channel. We note that we consider this additional strategy based on the purely discrete-variable encoding only in Fig. 2. Therefore in the following sections whenever we refer to the schemes based on the [[4,1,2]] code and the [[7,1,3]] code, we always refer to the concatenated-coded schemes with the GKP encoding at the lower level.

Performance of the concatenated-coded repeater architecture

We again assess the performance of our repeater scheme for the task of generating shared secret key using the six-state QKD protocol with advantage distillation. We note that the two considered outer codes also correct the X and Z errors independently, similarly to the GKP code. This means that the quadratic suppression of Y-errors also applies to the concatenated-coded scheme. Therefore we can continue to make use of the result of³⁸ and maximise the key by extracting it in Y basis. We note that Alice and Bob extract secret keys from the logical qubits. Hence, secret-key rate in bits per mode is calculated by dividing secret-key rates in bits per logical qubit, by 4 for the case of the [[4,1,2]] outer code and by 7 for the case of the [[7,1,3]] outer code. We again refer the reader to Supplementary Note 8 for the discussion of the considered QKD protocol.

We perform Monte-Carlo simulation for the evolution of errors in the $(\hat{q},\hat{p})$ quadratures in our repeater scheme. From the simulation we estimate the quantum bit error rate (QBER) and calculate the expected asymptotic secret-key rate. We run the simulation for different placements of the type-A and type-B repeater nodes. Specifically, we assume at least one type-A station per 10 km. We then consider denser configurations with more type-A stations and for each of these cases we vary m, the number of type-B stations placed between neighbouring type-A stations. We consider all such configurations for which, similarly as in the case of the GKP repeater chain, the minimum separation between the neighbouring stations is 250 m, that is the sum of the number of type-A and type-B stations per 10 km cannot exceed 40. We describe the details of the simulation in “Monte-Carlo simulation” section.

In the first step we consider only the repeater performance, that is we look for the repeater placement configuration that maximises the achievable secret-key rate. We look for the achievable distances with the concatenated-coded schemes, for which the achievable secret-key rate in bits per mode is larger than $r^{\prime} =0.01$. The results are presented in the bottom two tables in Fig. 3. We see that the achievable distances are much larger and can be attained with more relaxed parameters than for the GKP repeater scheme. Specifically, for η₀ = 0.97, the architecture based on the [[4,1,2]] code ([[7,1,3]] code) enables to achieve secret-key rate per optical mode larger 0.01 for total distances larger than 1000 km already with 16.2 dB (14.7 dB) of squeezing. For the [[7,1,3]] code achieving such secret-key rate for total distance close to 1000 km is also possible with much lower photon coupling efficiency of η₀ = 0.93 if 17.9 dB of GKP squeezing is considered.

Fig. 3: Achievable distances (km) over which secret-key rate in bits per mode stays above $r^{\prime} =0.01$ for the three considered repeater architectures.

We see that using two levels of encoding allows for achieving larger distances with more relaxed hardware parameters than just a single level of GKP encoding alone. For comparison, the corresponding distance over which the capacity of the pure-loss channel drops to K(L_tot) = 0.01 when perfect devices and the same attenuation length are considered is L_tot = 109 km. This is the distance over which we could maintain the secret-key rate per optical mode larger than 0.01 if we did not have access to quantum repeaters but could perform direct communication using optimal encoding and decoding strategy with perfect hardware. For the “only GKP” case, the data were obtained using ten iterations of the binary search method over distance in the interval [0, 10,000] km resulting in approximately 10 km accuracy, where for each of the considered distances the secret-key rate was evaluated using the analytical model described in Supplementary Note 5. For the concatenated-coded schemes we performed numerical Monte-Carlo simulations such that the effective error on the achievable distances is around 10%, see “Monte-Carlo simulation” section for details.

All the values from the tables in Fig. 3, can also be compared against the PLOB bound³⁴ introduced in “GKP repeater chain architecture” section and describing the limits of direct transmission. Since its value drops below K(L_tot) = 0.01 after L_tot = 109 km, we see that for most considered parameter regimes the concatenated-coded schemes easily overcome the optimal direct transmission. The relaxed hardware requirements, large achievable distances and performance against the PLOB bound show that our concatenated-coded schemes are promising architectures for long-distance quantum communication.

Performance versus cost trade-off of the concatenated-coded repeater architecture

Clearly the more costly denser placement of type-A repeaters results in better performance. Therefore in the second step we also take the repeater cost into account. Specifically, for each end-to-end distance we aim to minimise the normalised cost function defined as

$$C^{\prime} =\frac{{\text{Resources}}\, {\text{used}}\, {\text{per}}\, {\text{km}}}{{\text{achieved}}\, {\text{secret}}{\hbox{-}}{\text{key}}\, {\text{rate}}\, {\text{per}}\, {\text{mode}}}.$$

(6)

The natural way of counting the resources will clearly depend on the physical implementation of our scheme. Here, we count the resources by considering the needed number of GKP storage modes and the storage duration needed for these modes in both types of repeater nodes, see “Cost function” section for mathematical definition of the cost function. Specifically we consider not only the storage of the data modes, but also of the ancilla modes needed for error correction. We consider a discretization of all the operations into time steps, where one time step is needed either for preparing a GKP ancilla state or for performing all the two-mode Gaussian operations between a single data mode and the ancilla mode for the purpose of the inner or outer code stabiliser measurement. We describe the details of our scheduling procedure in Supplementary Note 10. For each of the needed storage modes, we count the number of time steps that this mode must be able to store the state for without losing or decohering it. Then we sum the number of these time steps for all the needed storage modes inside each repeater type to obtain the total cost of placing a given repeater. This way of estimating repeater cost applies e.g., to an architecture in which the repeaters would consist of coupled cavities, where each cavity is effectively used as a quantum memory for a single GKP mode during the correction operations. We discuss possible implementations in more detail in “Discussion” section as well as in “Cost function” section.

For the above discussed strategy of estimating the resources, the exact cost values are explicitly stated in “Cost function” section and derived in Supplementary Note 10. Here, we just note that in our architecture we add additional operations inside type-A repeaters, which aim at decreasing the noise effect of finite GKP squeezing. This includes performing additional GKP corrections between multi-qubit stabiliser measurements, and repeating the measurement of the second-level syndrome for better measurement reliability. As a result, we find that for the proposed scheduling of the operations the type-A repeater for the [[4,1,2]] code costs around 17 times more than the type-B repeater, while the type-A repeater for the [[7,1,3]] code costs around 78 times more than the type-B repeater. The numerator in the cost function in Eq. (6) is just the sum of the costs of Alice’s encoding station, and all the repeaters in the given configuration (including Bob’s decoding station which also performs quantum error correction and can be treated as a type-A repeater, see Supplementary Note 8 for more details) over the total communication distance L_tot, divided by this distance in km, see “Cost function” section for more detail. We note that while we do not specify the scheduling of operations at Alice’s encoding station, higher-level encoding from GKP qubits can be achieved by performing the same type of operations as performed inside repeaters. These include CV two-qubit Clifford gates and additional GKP corrections to limit the accumulation of errors due to finite squeezing in GKP modes. We have verified that such a procedure enables reliable higher-level encoding, where the probability of a logical error on any of the GKP data qubits during this procedure is smaller than the corresponding probability of error due to performing operations with finitely squeezed GKP ancilla modes during error-correction inside the type-A repeaters. The complexity of such an encoding does not exceed the corresponding complexity of operations performed inside the type-A repeater, and therefore in the cost function we assign to the encoding the same cost as to the type-A repeater. In our analysis, the cost function is minimised independently for each distance over all the repeater placement configurations.

Here, we perform the cost function analysis for the scenario with η₀ = 0.97 and with 17.9 dB of squeezing corresponding to σ_GKP = 0.09. In Fig. 4 we depict the optimal repeater placement configuration for each distance for the concatenated-coded architectures. We plot the optimal number of repeaters per 10 km for the hybrid architecture and for comparison for the architecture that uses only type-A repeaters. We see that the hybrid architecture enables us to use less of the expensive type-A repeaters thanks to the help of the cheaper type-B repeaters. Since type-B repeaters are cheap, we see that already for shorter distances it is optimal to place them densely. Moreover, we see that since the [[7,1,3]] code repeaters are more powerful than [[4,1,2]] code repeaters, we need less of the former ones in the first architecture than we need of the latter ones in the second one. We also observe that for the hybrid architectures the optimal number of type-A repeaters increases monotonically with distance, and the stepwise increase of this number may result in a stepwise decrease of the optimal number of type-B stations.

Fig. 4: Optimal repeater configuration which minimises the cost function for the concatenated-coded schemes.

The figure shows the optimal repeater placement for the architectures based on the [[4,1,2]] code and [[7,1,3]] code versus communication distance. We show the optimal number of type-A repeaters (solid green), type-B repeaters (solid blue) as well as the number of stations in the architecture that uses only type-A repeaters (dotted red). The considered parameters are η₀ = 0.97 and σ_GKP = 0.09. We see that using the hybrid scheme allows for reducing the density of the more costly type-A repeaters, with respect to the scheme that uses only type-A repeaters. We also see that since the [[7,1,3]] code type-A repeaters are powerful but costly, we need much less of them than the [[4,1,2]] code type-A repeaters. The type-B repeaters are cheap and so already for shorter distances it is beneficial to place them densely. For the scheme based on the [[4,1,2]] code we observe that for distances larger than around 2500 km the architecture utilising only type-A repeaters becomes optimal. The effect of the simulation error is described in “Monte-Carlo simulation” section.

We also describe the behaviour of the secret key under the cost function minimisation. Again, for each of the two second-level codes, we consider two architectures, one using only type-A stations and the second one using both types of repeaters. Let us then consider the amount of secret key in bits per mode $r^{\prime}$ that can be generated by each of these schemes. We plot $r^{\prime}$ for all the four architectures in Fig. 5. We see that the architectures based on the [[4,1,2]] code ([[7,1,3]] code) achieve $r^{\prime}\, >\,0.02$ ($r^{\prime}\, >\,0.06$) for all the distances up to 10,000 km. While under the cost function minimisation the hybrid schemes generate for most distances slightly less key than the corresponding schemes based only on type-A stations, there is no significant difference in performance trend with distance between these two schemes. The overall “zig-zag” shape of the curves is caused by discrete changes in the optimal repeater placement configurations with changing distance. We also see that for most distances the [[4,1,2]] code architectures can generate more key per optical mode than the corresponding [[7,1,3]] code architectures, since the former ones need less modes to transmit a logical qubit. However, we see that after around 4000 km the key starts decaying for the architectures based on the [[4,1,2]] code. This reveals that the [[4,1,2]] code schemes will not be able to sustain secret-key generation for distances much larger than 10,000 km. On the other hand the [[7,1,3]] code architectures maintain a steady $r^{\prime}$ for all the distances.

Fig. 5: Secret-key rate in bits per optical mode $r^{\prime}$ versus distance (km) for the concatenated-coded schemes.

We consider four schemes: two schemes based on the [[4,1,2]] code and two schemes based on the [[7,1,3]] code for η₀ = 0.97 and σ_GKP = 0.09. The blue solid lines correspond to the strategy with two types of repeaters, type-A and type-B stations, while the red dotted lines correspond to the schemes for which only multi-qubit repeaters are used. We see that the hybrid schemes exhibit similar performance as the schemes with only type-A stations. We also plot the PLOB bound, corresponding to the two-way assisted secret-key capacity of the pure-loss channel and therefore the ultimate limit of repeater-less quantum communication with perfect devices. Finally, we mark the saturation secret key, which is the maximum value ${r}_{\max }^{\prime}$ attainable with zero QBER. For the [[4,1,2]] code it is 1/4 and for the [[7,1,3]] code it is 1/7. We observe that the overall trend for the [[7,1,3]] code schemes is that they maintain a steady secret-fraction $r^{\prime}$ for all the considered distances while for the [[4,1,2]] code architectures the key starts decreasing for larger distances. All the schemes easily overcome the PLOB bound already for distances much smaller than 100 km. The effect of the simulation error is described in “Monte-Carlo simulation” section.

This conclusion can be also drawn from the consideration of the simulation error. Specifically, since the simulation data has at most 10% relative error, we have also investigated the corresponding behaviour for the upper-bound on the simulated logical X and Z flip probabilities. In particular, we have minimised the cost-function and investigated the resulting secret-key rate for the scenario, when the obtained X and Z flip probabilities are increased by 10% for all the repeater placement configurations. We find that this does not have any significant effect on the architectures based on the [[7,1,3]] code, that is the secret-key rate still stays such that $r^{\prime}\, >\,0.06$ for all the distances. However, for the [[4,1,2]] code schemes $r^{\prime}$ drops below 0.02 for 10,000 km now. This supports the observation that for the considered parameters the [[7,1,3]] code architectures remain robust even at such large distances. On the other hand, the [[4,1,2]] code schemes, which for distances close to 10,000 km require placement of type-A repeaters almost every 250 m, become sensitive to noise at these distances.

We note that for comparison in Fig. 5 we also plot the PLOB bound³⁴. We see that for the considered set of parameters all our architectures overcome the PLOB bound already for distances much smaller than 100 km.

The final question is how the costs of these different schemes compare. We plot the normalised cost function for all these schemes in Fig. 6. Since we have already verified that the performances of the hybrid scheme and the scheme utilising only type-A repeaters are similar, we conclude from this plot that the hybrid architecture enables us to save a lot of resources in comparison to the architecture based only on the more expensive type-A repeaters. This is because the performance benefits of using the more expensive type-A repeaters can be maintained by replacing some of them with the cheaper type-B repeaters. Secondly, we see that for shorter distances it is more resource-efficient to use the architecture based on the [[4,1,2]] code, while for larger distances the [[7,1,3]] architecture is preferable. This is linked to the fact that the type-A repeaters in the [[7,1,3]] code architecture are more expensive but also more powerful than the type-A repeaters in the [[4,1,2]] code architecture. For smaller overall losses at shorter distances these larger powerful repeaters are not necessary, while for larger distances they are more efficient at overcoming the overall high losses.

Fig. 6: Normalised cost function $C^{\prime}$ versus distance (km) for the concatenated-coded architectures.

The considered parameters are η₀ = 0.97 and σ_GKP = 0.09. We see that the hybrid scheme enables us to reduce the cost function with respect to the corresponding scheme that uses only type-A repeaters. We also see that for shorter distances it is more efficient to use the architecture based on the [[4,1,2]] code (solid red) since the type-A repeaters of the [[7,1,3]] code are expensive while their large error correcting capabilities are not needed for these distances. For larger distances the cost function is smaller for the [[7,1,3]] code architecture (solid blue), because these high error correcting capabilities allow for achieving better performance-cost trade-off than the use of the cheaper but less efficient [[4,1,2]] repeaters. The visible initial decrease of the cost function with distance for the solid blue line is caused by the initial cost of Alice’s encoding station. The effect of the simulation error is described in “Monte-Carlo simulation” section.

Discussion

Let us now discuss the experimental challenges related to our scheme. These will naturally depend on its physical implementation. In our cost-function analysis we have assumed an architecture, where all the GKP modes need to be placed in effective quantum memories for the duration of the error-correction operations. A possible implementation of such a CV-quantum memory that allows for preparation of the highly non-classical GKP state as well as GKP error correction is a superconducting microwave cavity as experimentally demonstrated in ref. ²⁰. Storing GKP data and ancilla modes in coupled microwave cavities at the repeater nodes would clearly require an efficient transduction between the telecom optical channel and the microwave regime^{43,44,45,46,47}.

On the other hand one could also consider an all-optical implementation, where all the repeaters perform error correction online on the flying GKP qubits stored and coupled to ancilla GKP modes directly in the optical fibre. Such an implementation would be similar in spirit to the all-photonic repeaters^13,14. Since storage of additional GKP modes in the same spool of optical fibre does not require additional quantum memories, the resource cost analysis for such an all-optical implementation will clearly differ from the one using the microwave-cavity-based repeaters. Since the all-optical preparation of GKP states remains a significant experimental challenge^{48,49,50,51,52}, the cost analysis presented here and the corresponding scheduling of operations discussed in Supplementary Note 10 are performed with respect to a model which is more suitable for the microwave cavity implementation.

Let us now compare the hardware requirements of our scheme with respect to other error-correction-based repeater proposals. The requirement on the photon coupling efficiency for our scheme is similar as for the proposed error-correction-based repeater architectures utilising discrete-variable encoding using tree codes and parity codes^{4,7,11,12,13,14}. On the other hand the need for operating on large number of modes/qubits, which is required for these schemes is removed in our scheme at the expense of the requirement for being able to prepare highly non-classical and highly squeezed GKP states in each of these few modes. We note that while for the discrete-variable encodings large number of entangled qubits are needed, the number of required entangled photons can be significantly reduced by multiplexing which allows for encoding multiple qubits in a single photon⁵³. In fact, if the average number of photons needed for the encoding is considered to be the main resource, then the relative cost of utilising such multiplexed schemes versus single-mode GKP encoding for combating photon loss depends on the channel transmissivity, see ref. ⁵³.

The experimentally demonstrated amount of GKP squeezing is in the regime 7.5–9.5 dB^18,19,20. Therefore more experimental progress is needed in order to achieve the required levels of squeezing predicted by our analysis. It would also be beneficial to study the effect of finite gate fidelity and finite storage time in our architecture²⁶. Furthermore, Steane error correction for GKP qubits has been demonstrated using an ancilla transmon qubit²⁰. Hence experimental procedures for using ancilla GKP modes need to be developed as well as the procedures for encoding and decoding the proposed two-level-coded qubits.

We note that our motivation for using the metric of secret-key rate in bits per optical mode as a way of assessing the repeater performance comes from the fact that this figure of merit has a clear operational meaning and quantifies the feasibility of a specific quantum communication task. Moreover, closely related figure of merits are also throughput and latency which quantify how much secret key can be generated per unit time, and how long it takes to generate the first raw key bit, respectively. We discuss the performance of our schemes with respect to these metrics in Supplementary Note 11. However, the considered repeater schemes can also enable and facilitate implementation of various tasks other than QKD. Specifically, the deterministic nature of these schemes could enable deterministic quantum state transfer as well as deterministic remote entanglement generation.

It is important to mention that the GKP encoding/decoding strategy based on effectively converting the pure-loss channel into the Gaussian random displacement channel using phase-insensitive amplification is an achievable strategy but not an optimal one. There exists a numerical proof based on semi-definite optimisation, that a more efficient strategy of using GKP codes against the pure-loss channel exists¹⁶. It is plausible that under the optimal decoding strategy, the single-mode GKP architecture with coupling efficiency and squeezing levels similar to the ones considered in our concatenated-coded schemes will be sufficient for long-distance quantum communication. However, the numerical nature of this proof makes it difficult to extract from the solution the corresponding decoding procedure. In particular such an optimal decoding procedure might require much more complex operations than phase-insensitive amplification as well as the need to use large number of ancilla systems. Therefore, further study is needed to establish the optimal decoding procedure for correcting loss errors using GKP code, and to evaluate its complexity and experimental feasibility.

Let us now summarise the future outlook of this work. Firstly, utilisation of microwave cavities in long-distance quantum communication will require experimental realisation of highly efficient transduction between the microwave and optical regimes⁴⁷. An alternative solution would be an all-optical realisation which would require implementation of GKP state preparation directly in the optical regime^{48,49,50,51,52}. Secondly, it could also be beneficial to incorporate autonomous GKP error correction into our procedure which does not require active measurements and feedback^19,54. This technique could potentially be more efficient than the considered GKP Steane error correction, though it would not provide us with the additional analogue information which we have seen plays a crucial role in the performance of the concatenated-coded schemes. Thirdly, additional improvements could come from investigation of the optimal decoding strategy for GKP code used against the action of the pure-loss channel¹⁶. Fourthly, our analysis shows that more experimental progress on GKP squeezing is needed as well as implementation of high photon coupling efficiency in order for the considered schemes to become practical. Finally, given the nature of the concatenated-coded repeater architecture in which multiple GKP qubits from a single outer-code encoding block are transmitted in sequence, it could be valuable to investigate the use of a quantum convolutional code⁵⁵ as the outer code, as this would allow for easier online error correction, e.g., in the all-photonic implementation.

Methods

Realistic GKP states

Since $\left|q\right\rangle$ and $\left|p\right\rangle$ eigenstates are unphysical and require infinite amount of squeezing and energy, the ideal GKP states defined in Eqs. (2) and (3) are also unphysical. Therefore we will consider imperfect GKP states corresponding to a finite amount of squeezing. Let $\left|{\psi }_{\text{GKP}}\right\rangle$ denote an ideal GKP state. Then an approximate GKP state can be obtained by applying a Gaussian envelope operator $\exp (-{\Delta }^{2}\hat{n})$ to the perfect GKP state. Here $\hat{n}$ is the photon number operator and Δ describes the width of each peak in the grid-structure of the GKP Wigner function. We can use displacement operators $\hat{D}(\alpha )=\exp [\alpha {\hat{a}}^{\dagger }-{\alpha }^{* }\hat{a}]$ to rewrite the approximate GKP state $\left|{\psi }_{\,\text{GKP}\,}^{{{\Delta }}}\right\rangle$ as²⁶:

$$\begin{array}{lll}\left|{\psi }_{\,\text{GKP}\,}^{{{\Delta }}}\right\rangle \,\propto \,\int \frac{{d}^{2}\alpha }{\pi }{\rm{Tr}}[\exp (-{{{\Delta }}}^{2}\hat{n}){\hat{D}}^{\dagger }(\alpha )]\hat{D}(\alpha )\left|{\psi }_{\text{GKP}}\right\rangle \\ \qquad\qquad\propto \,\int {d}^{2}\alpha \exp \left[-\frac{| \alpha {| }^{2}}{2{\sigma }_{\,\text{GKP}\,}^{2}}\right]\hat{D}(\alpha )\left|{\psi }_{\text{GKP}}\right\rangle .\end{array}$$

(7)

Here ${\sigma }_{\,\text{GKP}\,}^{2}=(1-{e}^{-{{{\Delta }}}^{2}})/(1+{e}^{-{{{\Delta }}}^{2}})$. We see that an imperfect GKP state can be described as a coherent superposition of randomly displaced ideal GKP states with a Gaussian envelope centred at zero displacement. Similarly as in ref. ²⁶, in our simulation we consider a more conservative error model for imperfect GKP states. Specifically, let us define the Gaussian random displacement channel as:

$${{\mathcal{N}}}_{\text{disp}}[\sigma ](\rho )=\frac{1}{\pi {\sigma }^{2}}\int {d}^{2}\alpha \exp \left[-\frac{| \alpha {| }^{2}}{{\sigma }^{2}}\right]\hat{D}(\alpha )\rho {\hat{D}}^{\dagger }(\alpha ).$$

(8)

Then by adding further twirling noise to the state in Eq. (7), we can remove the coherences between the superposition terms with different values of the displacement amplitude α. This can be done by applying random displacements by an integer multiple of $2\sqrt{\pi }$ in each quadrature, such that for the relevant amount of GKP squeezing considered here, we obtain a state that can be described as²⁶:

$${\rho }_{\text{GKP}}[{\sigma }_{\text{GKP}}]={{\mathcal{N}}}_{\text{disp}}[{\sigma }_{\text{GKP}}](\left|{\psi }_{\text{GKP}}\right\rangle \! \left\langle{\psi }_{\text{GKP}}\right|).$$

(9)

Hence, we can simulate the imperfect GKP state by sampling displacement values ${\xi }_{q}^{\,\text{GKP}\,}$ and ${\xi }_{p}^{\,\text{GKP}\,}$ along the $\hat{q}$ and $\hat{p}$ quadratures respectively from the normal distribution centred at zero and with standard deviation σ_GKP: ${\xi }_{q}^{\,\text{GKP}},{\xi }_{p}^{\text{GKP}\,} \sim {\mathcal{N}}(0,{\sigma }_{\text{GKP}})$. We then consider an ideal GKP state that has been displaced according to these values.

Cost function

In this section, we make the notion of the repeater cost mathematically precise by defining a cost function, whose minimisation aims at finding the best trade-off between the repeater performance and the resource cost. We also propose a specific scheduling procedure for the operations in all the repeaters and aim to minimise the cost function under this scheduling model.

The resource cost as well as duration and time scheduling of all the operations performed within the proposed repeaters will naturally depend on the physical implementation of our scheme. Two possible implementations for which the scheduling of the operations and the natural way of counting the resources would be very different are repeaters that store GKP modes inside microwave cavities and all-optical stations in which all the operations are performed on the fly while the GKP data and ancilla qubits are stored in the spools of optical fibre. The main difference between the two implementations from the perspective of the scheduling of operations as well as estimating resource cost is the fact that the first implementation entails the use of effective quantum memories that are required for storing the GKP modes. Hence if the number of such memories (e.g., microwave cavities) is limited, then not all the GKP data modes can be operated on simultaneously, while increasing the number of such available memories will clearly increase the resource cost of the stations. On the other hand, the all-optical implementation does not involve the concept of such quantum memories, as all the modes are operated on in the optical fibre. Hence, the main limiting factor with respect to the delay between the consecutive GKP qubits will be in this case the repetition rate of the GKP source. As discussed in the main text, here we perform the analysis under the model of the first implementation involving the CV-quantum memories, motivated by the experimental demonstration of GKP error correction in a superconducting microwave cavity²⁰.

For the considered model, the cost of the resources can be measured by the amount of GKP storage modes times the storage time in all the repeaters needed for communication over the distance L_tot. Let t_GKP denote the cost of the single GKP repeater and t_multi-qubit the cost of the single multi-qubit repeater. Then for each of these repeater types

$$t=\mathop{\sum }\limits_{i=1}^{m}{k}_{{\rm{i}}}.$$

(10)

Here m denotes the number of storage modes (both for data and ancilla GKP qubits) that are required in a given repeater. Then the mode i in that repeater needs to be able to store a GKP qubit for k_i time steps defined below.

These repeater costs depend on the specific scheduling scheme of the operations performed inside the repeaters. Here, we consider a specific scheduling scheme based on the following assumptions:

• 1. We assume full connectivity, that is a two-qubit gate can be performed between any two GKP qubits inside every repeater.

• 2. We measure time of performing all the operations inside repeaters in time steps. We assume that one time step is the time of performing each of the following procedures:

  • preparing an ancilla GKP qubit,

  • applying a two-qubit gate between a data and an ancilla GKP qubit followed by a homodyne measurement of the ancilla and a subsequent feedback displacement of the data qubit; for the first or last operation on a given data mode inside a given repeater, the process of receiving or sending out a GKP qubit is also incorporated in this time step.

Clearly the second procedure involves more steps, but consists solely of Gaussian operations which are experimentally much easier to realise than the first procedure of GKP state preparation. Preparing GKP states requires a source of optical non-linearity as the GKP state is highly non-classical.

The detailed scheduling of all the operations performed inside the repeaters is described in Supplementary Note 10, where it is shown that within our model the cost of the type-B repeater is t_GKP = 4, the cost of the type-A repeater based on the [[4,1,2]] code is t_4-qubit = 68, while the cost of the type-A repeater based on the [[7,1,3]] code is t_7-qubit = 311.

Now we can define the cost function that measures both the performance and cost for the concatenated-coded schemes as:

$$C({L}_{\text{tot}},\,{N}_{{\text{multi}}\hbox{-}{\text{qubit}}},\,{N}_{\text{all}})=\frac{\frac{{L}_{\text{tot}}}{10}* \left({t}_{\text{GKP}}({N}_{\text{all}}-{N}_{{\text{multi}}\hbox{-}{\text{qubit}}})\,+\,{t}_{{\text{multi}}\hbox{-}{\text{qubit}}}{N}_{{\text{multi}}\hbox{-}{\text{qubit}}}\right)\,+\,{t}_{{\text{multi}}\hbox{-}{\text{qubit}}}}{r^{\prime} ({L}_{\text{tot}},\,{N}_{{\text{multi}}\hbox{-}{\text{qubit}}},\,{N}_{\text{all}})}\ .$$

(11)

Here $r^{\prime}$ is the secret-key rate per optical mode defined in Supplementary Note 8 and t_multi-qubit can correspond to t_4-qubit or t_7-qubit depending on the considered architecture. Moreover, the total distance L_tot is expressed in km, N_all is the number of all repeaters per 10 km and N_multi-qubit is the number of multi-qubit repeaters per 10 km. That is, e.g., if after a type-A repeater there is a type-B repeater 5 km away and then another type-A repeater after another 5 km, such that the repeater types oscillate every 5 km, then N_all = 2 and N_multi-qubit = 1. Such convention has the nice feature that it is then reasonable to only consider cases when N_all is a multiple of N_multi-qubit. This is because we can think of our architecture as firstly placing multi-qubit repeaters equidistant to each other and then adding GKP repeaters in between such that all the neighbouring type-B stations are also equidistant to each other. Moreover, the separation between the consecutive multi-qubit repeaters is then 10/N_multi-qubit km, while the spacing between any two neighbouring repeaters (independently of their types) is 10/N_all km. The choice of 10 km as a reference distance is motivated by the fact that for all parameter regimes that we consider and for L_tot of at least 500 km, it turns out that the optimal repeater configuration requires more than one type-A repeater per 10 km, see Fig. 4. Hence we then only consider configurations in which N_multi-qubit and N_all are positive integers. We see that in Eq. (11) we include a residual t_multi-qubit term to account for Alice’s encoding station, which we expect to have a similar cost as the type-A repeater. Bob’s decoding station performs multi-qubit error correction and therefore counts as a type-A repeater and is implicitly included in N_multi-qubit for the last 10 km segment.

Now, we aim to optimise our repeater configuration by minimising this cost function over N_multi-qubit and N_all for each distance L_tot. We note that for practical terms it can be more informative to minimise a normalised cost function, which for a given distance L_tot counts resources per km rather than for the total distance:

$$\begin{array}{lll}C^{\prime} ({L}_{\text{tot}},\,{N}_{{\text{multi}}\hbox{-}{\text{qubit}}},\,{N}_{\text{all}})\,=\,\frac{C({L}_{\text{tot}},\,{N}_{{\text{multi}}\hbox{-}{\text{qubit}}},\,{N}_{\text{all}})}{{L}_{\text{tot}}}\\ \qquad\qquad\qquad\qquad\qquad\quad=\,\frac{{L}_{\text{tot}}({t}_{\text{GKP}}({N}_{\text{all}}-{N}_{{\text{multi}}\hbox{-}{\text{qubit}}})\,+\,{t}_{{\text{multi}}\hbox{-}{\text{qubit}}}{N}_{{\text{multi}}\hbox{-}{\text{qubit}}})\,+\,10{t}_{{\text{multi}}\hbox{-}{\text{qubit}}}}{10{L}_{\text{tot}}\,*\, r^{\prime} ({L}_{\text{tot}},\,{N}_{{\text{multi}}\hbox{-}{\text{qubit}}},\,{N}_{\text{all}})}\ \ .\end{array}$$

(12)

This normalised cost function is plotted in Fig. 6.

Monte-Carlo simulation

Analytical modelling of the performance of the concatenated-coded repeater architectures is challenging. This is due to multiple effects. Firstly, even assuming the use of ideal GKP states, the analogue information does not allow us to correct all the single-qubit errors for the [[4,1,2]] code and all the single-qubit and two-qubit errors for the [[7,1,3]] code on the higher level. Specifically, from the simulation we see that the performance of the repeater in correctly identifying those errors depends on the channel parameters, that is, depending on the standard deviation σ of the effective Gaussian random displacement channel between the repeaters we observe a different fraction of the single-qubit and two-qubit logical GKP errors which the higher-level code fails to identify correctly and therefore fails to correct. In general, the larger σ, the higher the probability of misidentifying the erroneous qubit(s) on the second level. Moreover, the use of imperfect GKP ancillas together with the rescaling coefficients for the feedback displacement make it impractical to model errors after GKP correction as discrete Pauli errors on GKP qubits. Therefore we evaluate the performance of our scheme using a Monte-Carlo simulation for specific parameters.

We perform numerical Monte-Carlo simulation by tracking the evolution of the errors in the $\hat{q}$ and $\hat{p}$ quadratures. While at the end of the simulation we would like to identify logical errors on the second level, the actual quadrature shifts on all the data qubits are continuous. Specifically, the imperfect squeezing in the GKP ancillas means that the final state of the qubits will in general be neither in the GKP code space nor in the second-level code space. Therefore, we finish by applying first a round of virtual perfect GKP correction on all the GKP qubits, and then a round of virtual perfect second-level correction to bring the state to the code space of both codes. As here we just want to identify the closest logical state, we do not consider any analogue information for this virtual corrections. These perfect corrections can be thought of as being performed using perfect infinitely squeezed ancilla GKP modes. The perfect GKP correction brings all the GKP data qubits to the nearest state in the code space, such that we can now assign to them discrete values quantifying whether a logical X and/or Z error has taken place. Then the perfect multi-qubit correction (now without using the analogue information) brings the state to the nearest logical state on the second level, such that we can now count whether a logical error on the second level has taken place.

We find that it is not enough to simulate a single link between two consecutive type-A repeaters. When simulating only a single such link, there is a high probability that due to finite ancilla squeezing, before the perfect virtual multi-qubit correction we will be in a state that is outside of the code space on the second level and has e.g., a single GKP data qubit flipped. In the real-life scenario such a residual error on the second level would carry over to the next elementary link. Therefore the perfect virtual multi-qubit correction after a single link could significantly underestimate the error rate by effectively removing all such residual errors. However, we can simulate multiple consecutive links with the virtual correction only at the very end. In that case such a residual error on the second level before the final perfect virtual correction will only occur if there is a failure in correctly identifying the second-level stabilisers in the last link before the simulation end. This probability is always the same, that is, it is independent of the number of links we are simulating. Yet, if we simulate multiple links then the total error accumulates so the probability of logical error after large number of links is much larger than after a single link. Therefore, we simulate a chain of 100 such links before the virtual correction, and in this way we make the probability of such a residual error negligible relative to the probability of the actual logical error.

For each quadrature we start the simulation directly after the multi-qubit correction in that quadrature in the first repeater assuming that each GKP data qubit carries a residual Gaussian random displacement error from a channel with variance ${c}_{\text{opt}}{\sigma }_{\text{GKP}\,}^{2}$ coming from the last GKP correction from the preceding link. Here c_opt is the optimal coefficient used to rescale the GKP syndrome during error correction, see Supplementary Note 2 for more details. We then evolve this quadrature following all the error channels and correction operations as described in Supplementary Notes 5, 6, 7, and 10. We finish the simulation directly after the multi-qubit correction in that quadrature after the 100th link. We note that this means that the simulation of the $\hat{q}$ quadrature evolution has its beginning and end shifted with respect to the simulation of the $\hat{p}$ quadrature given that the multi-qubit syndrome measurements in those two quadratures happen at different times. Finally, after the virtual corrections, we read off whether a logical error on the second level has occurred in any of the two quadratures. Hence from the simulation we extract the probabilities of X and Z logical errors p_err,X/Z(η₀, σ_GKP, N_multi-qubit, N_all) over such 100 elementary links. We can then discretise these errors, assigning a well-defined probability of a logical error for a single elementary link given by ${P}_{\text{err,X/Z}}=\frac{1-{(1-2{p}_{\text{err,X/Z}})}^{1/100}}{2}$. Hence, we consider that the logical error over 100 links is given by an odd number of these effective discrete logical errors over single links. We can then use the values of p_err,X and p_err,Z obtained from the simulation to calculate the total probabilities of X and Z errors over the total distance L_tot by considering the probabilities of odd number of such errors over the entire channel. These can be obtained by substituting P_err,XZ into the equation:

$${Q}_{\text{err,X/Z}}=\frac{1-{(1-2{P}_{\text{err,X/Z}})}^{{L}_{\text{tot}}/L}}{2}.$$

(13)

where L is the length of the single link given by L = 10/N_multi-qubit. As a result we have that:

$${Q}_{\text{err,X/Z}}({\eta }_{0},\,{\sigma }_{\text{GKP}},\,{N}_{{\text{multi}}\hbox{-}{\text{qubit}}},\,{N}_{\text{all}},\,{L}_{\text{tot}})\,=\,\frac{1-{(1-2{p}_{\text{err,X/Z}})}^{{N}_{{\text{multi}}\hbox{-}{\text{qubit}}}{L}_{\text{tot}}/1000}}{2}.$$

(14)

Then this leads to an effective channel over L_tot given by:

$${\mathcal{D}}(\rho )=(1-{q}_{{\rm{X}}}-{q}_{{\rm{Z}}}-{q}_{{\rm{Y}}})\rho +{q}_{{\rm{X}}}X\rho X+{q}_{{\rm{Z}}}Z\rho Z+{q}_{{\rm{Y}}}Y\rho Y.$$

(15)

with q_X = Q_err,X(1 − Q_err,Z), q_Z = Q_err,Z(1 − Q_err,X), and q_Y = Q_err,XQ_err,Z. This enables us to calculate the secret-key rate per mode as described in Supplementary Note 8 and then the normalised cost function given in Eq. (12).

For each considered setting of the experimental parameters η₀ and σ_GKP we run the simulation for multiple configurations of {N_multi-qubit, N_all}. That is, we start with N_multi-qubit = N_all = 1 and then rerun the simulation for the configurations for which N_all is a multiple of N_multi-qubit, where we place a limit of 250 m on the minimum repeater spacing (N_all ≤ 40 and N_multi-qubit ≤ 40). In order to find the achievable distances presented in Fig. 3 and in Supplementary Fig. 4 we maximise this secret-key rate for each distance by choosing the setting of {N_multi-qubit, N_all} and the corresponding p_err,X/Z which gives the highest secret-key rate for that distance L_tot. Then we look for the largest distance for which such secret-key rate per mode stays above 0.01. We proceed similarly when calculating the optimal resource-cost trade-off. Then for each distance we minimise the cost function by choosing this setting of {N_multi-qubit, N_all} and the corresponding p_err,X/Z which gives the smallest cost function for that distance L_tot. We also evaluate the cost function for the architecture based solely on multi-qubit stations by imposing the additional constraint {N_multi-qubit = N_all}.

In a similar spirit, we also run a Monte-Carlo simulation for a GKP repeater chain to verify the analytical model described in Supplementary Note 5. To include the effect of the residual displacements after GKP correction in a given repeater on the probability of successful correction in the next repeater, also in this case we simulate a chain of 100 elementary links, where this time an elementary link is a single link between the neighbouring type-B repeaters. We again simulate the errors in the two quadratures independently, where the simulation in each quadrature starts directly after the corresponding GKP correction, so that the initial error displacement comes from a distribution with variance ${c}_{\text{opt}}{\sigma }_{\text{GKP}\,}^{2}$. We then simulate 100 elementary links and apply the virtual perfect GKP correction at the end. We read-off whether there was a logical X or Z error, so that from the statistics we can extract the value of p_err,X/Z. Here p_err,X/Z is the X or Z logical error probability over a chain of 100 GKP repeaters. Analogously to the concatenated-coded architecture, we calculate the logical X and Z error probability for the total distance L_tot:

$${Q}_{\text{err,X/Z}}({\eta }_{0},\,{\sigma }_{\text{GKP}},\,{N}_{\text{GKP}},\,{L}_{\text{tot}})=\frac{1-{(1-2{p}_{\text{err,X/Z}})}^{{N}_{\text{GKP}}{L}_{\text{tot}}/1000}}{2},$$

(16)

where N_GKP is the number of GKP stations per 10 km. We can then extract the corresponding secret-key rate per optical mode $r^{\prime}$ in the same way as described above for the concatenated-coded scheme. The results of our Monte-Carlo simulation for the GKP repeater chain verify the analytical model from Supplementary Note 5 as shown in Supplementary Fig. 4.

Now we also specify how we determine the accuracy of the simulations. When simulating a chain of 100 elementary links, we start with the sample of size k = 10 and calculate the estimates of the standard error for the probability of logical X and Z flips p_err,X/Z as:

$${{\Delta }}{p}_{\text{err,X/Z}}=\sqrt{\frac{{p}_{\text{err,X/Z}}(1-{p}_{\text{err,X/Z}})}{k}}\ ,$$

(17)

where the numerator is the standard deviation of the Bernoulli distribution. Then we calculate the relative error Δp_err,X/Z/p_err,X/Z and check whether it is smaller than a threshold b which we set. If not we increase k by a factor of 10 and repeat the procedure. We iterate until the relative error becomes smaller than the threshold b. We then estimate the upper-bound and lower-bound on the achievable distance presented in Fig. 3 and in Supplementary Fig. 4 by performing the above described optimisation of the secret-key rate per mode for each distance L_tot not only for the logical error probabilities {p_err,X, p_err,Z} but also for the values {(1 − b)p_err,X, (1 − b)p_err,Z} leading to the upper-bound and {(1 + b)p_err,X, (1 + b)p_err,Z} leading to the lower-bound. For the simulations of the concatenated-coded schemes in Fig. 3 we set b = 0.1 and for the simulations of the GKP repeater chain in Supplementary Fig. 4 we set b = 0.02. The optimal repeater placement configuration presented in Fig. 4, the minimised cost function presented in Fig. 6 and the behaviour of secret-key rate per mode under cost function minimisation shown in Fig. 5 have all been obtained from the simulated data with the accuracy given by b = 0.1.

Let us now briefly discuss the effect of minimising the cost function for the concatenated-coded schemes when taking the simulation error into account, that is when we increase or decrease {p_err,X, p_err,Z} by 10% for the parameters η₀ = 0.97 and σ_GKP = 0.09. We have already mentioned in “Repeater architecture based on concatenated GKP and discrete-variable codes” section that increasing the logical error probabilities by 10% leads to a visible decrease of the secret-key rate for the [[4,1,2]] scheme for 10,000 km. We also find that decreasing the logical error probabilities by 10% for this scheme leads to a visible increase of the secret-key rate above $r^{\prime} =0.03$ for that distance. Moreover, when varying the logical error probabilities within this confidence interval we find a visible change in behaviour for the first 200 km for both concatenated-coded schemes based on only type-A repeaters. Specifically, for distances up to around 100 km when the logical error probabilities are decreased by 10%, the optimal repeater configuration for these schemes requires only a single multi-qubit repeater per 10 km, which also significantly lowers the achievable secret-key rate in that regime, yet allows to significantly decrease the cost function relative to the values shown in Fig. 6. Finally, there is also a visible change in behaviour for the hybrid schemes when varying the logical error probabilities within the confidence interval, yet again only for the first 200 km. This change corresponds to the change of the optimal number of type-B repeaters within that distance regime, which for the scheme based on the [[4,1,2]] code also affects the amount of generated secret key and the cost function in that distance regime.

Finally, we note that we also run a simple simulation of a single elementary link with channel loss γ and ideal GKP and higher-level correction at the end in order to obtain the data presented in Fig. 2. As in this case there are no residual errors after correction, it is then sufficient to simulate only a single such elementary link rather than 100 consecutive links. For this single link we extract from the simulation the probabilities of logical X and Z flips, p_err,X/Z. These probabilities are then used to calculate the maximum infidelity given by:

$${\epsilon }_{\max }={q}_{{\rm{X}}}+{q}_{{\rm{Z}}},$$

(18)

where q_X = p_err,X(1 − p_err,Z) and q_Z = p_err,Z(1 − p_err,X), as shown in the Supplementary Note 9. We similarly use Eq. (17) to calculate the standard error on p_err,Z and p_err,X and again require the corresponding relative errors to be smaller than b. We can then calculate the relative error on ${\epsilon }_{\max }$ as follows. Firstly, the relative error on q_X is bounded by:

$$\begin{array}{lll}\frac{{{\Delta }}{q}_{{\rm{X}}}}{{q}_{{\rm{X}}}}\,=\,\sqrt{{\left(\frac{{{\Delta }}{p}_{\text{err,X}}}{{p}_{\text{err,X}}}\right)}^{2}+{\left(\frac{{{\Delta }}{p}_{\text{err,Z}}}{1-{p}_{\text{err,Z}}}\right)}^{2}}\\ \qquad\le \,b\sqrt{1+{\left(\frac{{p}_{\text{err,Z}}}{1-{p}_{\text{err,Z}}}\right)}^{2}}\ .\end{array}$$

(19)

Similarly:

$$\frac{{{\Delta }}{q}_{{\rm{Z}}}}{{q}_{{\rm{Z}}}}\le b\sqrt{1+{\left(\frac{{p}_{\text{err,X}}}{1-{p}_{\text{err,X}}}\right)}^{2}}.$$

(20)

Let us define now $u=1+{\left(\frac{{p}_{\text{err,Z}}}{1-{p}_{\text{err,Z}}}\right)}^{2}$ and $v=1+{\left(\frac{{p}_{\text{err,X}}}{1-{p}_{\text{err,X}}}\right)}^{2}$. From here we can bound the relative error on the maximum infidelity as:

$$\frac{{{\Delta }}{\epsilon }_{\max }}{{\epsilon }_{\max }}\le b\frac{\sqrt{u{q}_{{\rm{X}}}^{2}+v{q}_{{\rm{Z}}}^{2}}}{{q}_{{\rm{X}}}+{q}_{{\rm{Z}}}}.$$

(21)

Since u and v are close to one, we see that the relative error on ${\epsilon }_{\max }$ is smaller than b. In the simulation we set b = 0.1. We then run the simulation for 101 values of γ in the interval [0.08, 0.2]. We find that the relative error on ${\epsilon }_{\max }$ is around 7% for all the data points.