The $125 Million Mistake Where Nobody Made a Mistake

Every mistake here was made by somebody competent, doing their job properly. That is what makes them interesting.

What they share is a system with no way to catch a small, reasonable error. So the error travels, gathers speed and presents a bill at the other end.

The Mars probe

A spacecraft was sent to Mars. It went behind the planet and was never heard from again. One team had worked in metric units and the other in imperial.

That is where most tellings stop. The interesting part is that neither team made a mistake. Each built exactly what it was asked for, and each half was tested correctly. The error lived in the gap between them, and nobody owned the gap.

The craft flew a slightly wrong course for nine months. Navigators noticed the numbers drifting and reported it. The reports went into a queue.

It arrived far too low. The bill was about $125 million.

The missing bar

In 1962 a rocket carrying America's first interplanetary probe was destroyed on purpose less than five minutes after launch, because it had begun to steer in a way nobody could explain.

The guidance software came from a handwritten formula. One symbol had a small bar over it, meaning "use the smoothed average and ignore the jitter". The bar did not make it into the code.

So the rocket tried to correct every tiny fluctuation. It chased noise. The cost was about $18 million at the time.

The airliner that became a glider

A passenger jet ran out of fuel at 41,000 feet over Canada. The country had recently switched to metric. The fuel gauge was broken, so the load was worked out by hand, using the old conversion factor.

Three people checked the arithmetic. All three used the same wrong number.

Both engines stopped. The pilot happened to be an experienced glider pilot, and he landed on a disused airstrip that had become a racetrack. Nobody died.

Checking three times is worthless if all three checks use the same source.

45 minutes

A trading firm deployed new software to eight servers. It reached seven. The eighth still held an old function that had been switched off years before, and the new code reused the flag that used to turn it on.

The eighth server began buying and selling at enormous speed. Alerts fired, but they had been firing for weeks about other things, so nobody trusted them.

An alarm that is usually wrong is not an alarm. It is furniture.

The firm lost about $460 million in 45 minutes and was sold within days. Every line of the code was correct. The mistake was assuming the old meaning was gone.

Fat fingers

• A trader meant to sell one share at 600,000. He sold 600,000 shares at one.
• One bank paid out 900 million because somebody clicked the wrong option.
• A manufacturer lost 40 million euros to an invoice sent from a misspelled email domain.

The defence against every one of these is the same, and it is boring. Somebody else looks.

Sensible decisions

The most expensive mistakes are not the fast ones.

A record label turned down a band because guitar groups were on the way out. A phone maker built a touchscreen, tested it and decided against it. A video rental chain was offered a small streaming company and laughed. A camera company invented the digital sensor and shelved it to protect its film business.

Each decision was defensible at the time. They were not stupid. Being right too early looks the same as being wrong, until it does not.

Why it keeps happening

Almost every one of these was caught by somebody, and the catch went nowhere. The person who raised it was junior, busy and not certain enough to insist.

Certainty is the wrong bar. Nobody is certain before the thing happens. A junior engineer with a bad feeling is the cheapest safety system ever invented, and the most ignored.

Aviation learned this and made it a rule that anybody can stop a procedure. It is one reason flying is so safe.

The short answer

In every case somebody had a doubt, and the doubt was cheaper than the bill by a factor of millions. Nothing here needed a genius. It needed an afternoon and somebody willing to be annoying.