circuit for each face is the same as the $Z$-stabilizer circuit for that face, replacing CNOT gates acting on data qubits by XNOT gates. The $Z$ component of the flag error set of the circuit in \[fig:StabFTwithAncilla\] is $\mathcal{E}_Z(Z_{q_1}Z_{q_2}Z_{q_3}Z_{q_4}) = \{ I,Z_{q_1},Z_{q_4},Z_{q_3}Z_{q_4} \}$. As can be seen from \[fig:SteaneColor1\], each of these has a distinct syndrome, thus the measurement circuit for $Z_{q_1}Z_{q_2}Z_{q_3} Z_{q_4}$ satisfies the flag $1$-FTEC condition, as do the remaining five measurement circuits by symmetry.

Flag $2$-FTEC with distance-5 codes {#subsec:Distance5protocol}
-----------------------------------

Before explicitly describing the conditions and protocol, we discuss some of the complications that arise for codes with $d>3$.

For distance-5 codes, we must ensure that if two faults occur during the error correction protocol, the output state will differ from a codeword by an error of at most weight-two. For instance, if two faults occur in a circuit for measuring a stabilizer of weight greater than four, the resulting error $E$ on the data should satisfy $\text{wt}(E) \le 2$ unless there is a flag. In other words, all stabilizer generators should be measured using 2-flag circuits.

In another case, two faults could occur during the measurement of *different* stabilizer generators $g_{i}$ and $g_{j}$. If two 