be $E_{j}{|\bar{\psi}\rangle}$ with the first condition implying $\text{wt}(E_{j})\leq j \cdot s$ provided that $j \leq n$. However, when $j > n$, the requirement of the first condition is no longer satisfied so we cannot use it to upper bound $\text{wt}(E_{j})$. Now consider the same scenario but assuming both conditions hold. The second condition implies that after the first round, the input state $E_{1}{|\bar{\psi}\rangle}$ becomes $E'_{2}{|\bar{\phi}\rangle} = E_{2}{|\bar{\psi}\rangle}$, with $\text{wt}(E_{2}')\leq s$, and where ${|\bar{\phi}\rangle}$ is a codeword. Therefore the codewords are related by: ${|\bar{\phi}\rangle}= (E_{2}^{'\dagger} E_{2}) {|\bar{\psi}\rangle}$, with logical operator $(E_{2}^{'\dagger} E_{2})$ having weight at most $3s$, since $\text{wt}(E_{2})+\text{wt}(E_{2}') \leq 3s$. However, the minimum non-trivial logical operator of the code has weight $(2t+1)>3s$, implying that ${|\bar{\psi}\rangle} = {|\bar{\phi}\rangle}$, and therefore that $\text{wt}(E_{2}) = \text{wt}(E_{2}') \leq s$. Hence, for the $j$th round, $\text{wt}(E_{j}) \leq s$ for all $j$, i.e. the distance from the codeword is not increased by consecutive error correction rounds with $s$ faults, provided $s < (2t+1)/3$.

![An example showing the first fault tolerance condition alone in \[Def:FaultTolerantDef\] is not sufficient to imply a long lifetime. We represent $s$ faults occurring during a round of error correction with a vertical arrow, and a state a distance $r$ from the desired 