Humble Pi: When Math Goes Wrong in the Real World

by Matt Parker

Leonard never got his jet, and Leonard v. Pepsico, Inc. is now a part of legal history. I, personally, find it reassuring that, if I say anything that I characterize as “zany humor,” there is legal precedent to protect me from people who take it seriously. And if anyone has a problem with that, simply collect enough Parker Points for a free photo of me not caring (postage and handling charges may apply).

We know a million, a billion, and a trillion are different sizes, but we often don’t appreciate the staggering increases between them. A million seconds from now is just shy of eleven days and fourteen hours. Not so bad. I could wait that long. It’s within two weeks. A billion seconds is over thirty-one years. A trillion seconds from now is after the year 33,700 CE.

During our lives we learn that numbers are linear, that the spaces between them are all the same. If you count from one to nine, each number is one more than the previous one. If you ask someone what number is halfway between one and nine, they will say five—but only because they have been taught to. Wake up, sheeple! Humans instinctively perceive numbers logarithmically, not linearly. A young child or someone who has not been indoctrinated by education will place three halfway between one and nine. Three is a different kind of middle. It’s the logarithmic middle, which means it’s a middle with respect to multiplication rather than addition: 1 × 3 = 3; 3 × 3 = 9. You can go from one to nine either by adding equal steps of four or multiplying by equal steps of three. So the “multiplication middle” is three, and that is what humans do by default, until we are taught otherwise. When members of the indigenous Munduruku group in the Amazon were asked to place groups of dots where they belong between one dot and ten dots, they put groups of three dots in the middle. If you have access to a child of kindergarten age or younger with parents who don’t mind you experimenting on them, they will likely do the same thing when distributing numbers.

A UK National Lottery scratch card had to be pulled from the market the same week it was launched. Camelot, the company that runs the UK lottery, put it down to “player confusion.” The card was called Cool Cash and came with a temperature printed on it. If a player’s scratching revealed a temperature lower than the target value, they won. But a lot of players seemed to have an issue with negative numbers: On one of my cards it said I had to find temperatures lower than −8. The numbers I uncovered were −6 and −7 so I thought I had won, and so did the woman in the shop. But when she scanned the card, the machine said I hadn’t. I phoned Camelot and they fobbed me off with some story that −6 is higher, not lower, than −8, but I’m not having it.

On September 14, 2004, around eight hundred aircraft were making long-distance flights above Southern California. A mathematical mistake was about to threaten the lives of the tens of thousands of people onboard. Without warning, the Los Angeles Air Route Traffic Control Center lost radio voice contact with all the aircraft. A justifiable amount of panic ensued. The radios were down for about three hours, during which time the controllers used their personal cell phones to contact other traffic control centers to get the aircraft to retune their communications. There were no accidents but, in the chaos, ten aircraft flew closer to each other than regulations allowed (five nautical miles horizontally or two thousand feet vertically); two pairs passed within two miles of each other. Four hundred flights on the ground were delayed and a further six hundred canceled. All because of a math error. Official details are scant on the precise nature of what went wrong, but we do know it was due to a timekeeping error within the computers running the control center. It seems the air-traffic control system kept track of time by starting at 4,294,967,295 and counting down once a millisecond. Which meant that it would take 49 days, 17 hours, 2 minutes, and 47.295 seconds to reach 0. Usually, the machine would be restarted before that happened, and the countdown would begin again from 4,294,967,295. From what I can tell, some people were aware of the potential issue, so it was policy to ...

Why would Microsoft, Los Angeles Air Route Traffic Control Center, and Boeing all limit themselves to this seemingly arbitrary number of around 4.3 billion (or half of it) when keeping track of time? It certainly seems to be a widespread problem. There is a massive clue if you look at the number 4,294,967,295 in binary. Written in the 1s and 0s of computer code, it becomes 11111111111111111111111111111111; a string of thirty-two consecutive ones.

If you had space for only five digits on a piece of paper, the largest number you could write down would be 99,999. You’ve filled every spot with the largest digit available. What the Microsoft, air-traffic control, and Boeing systems all had in common is that they were 32-bit binary-number systems, which means the default is that the largest number they can write down is thirty-two 1s in binary, or 4,294,967,295 in base-10. It was slightly worse in systems that wanted to use one of the thirty-two spots for something else. If you wanted to use that piece of paper with room for five symbols to write down a negative number, you’d need to leave the first spot free for a positive or negative sign, which would mean that you could now write down all the whole numbers between −9,999 and +9,999. It’s believed Boeing’s system used such “signed numbers,” so, with the first spot taken,* they only had room for a maximum of thirty-one 1s, which translates into 2,147,483,647. Counting only centiseconds rather than milliseconds bought them some time—but not enough. Thankfully, this is a can that can be kicked far enough down the road that it does not matter. Modern computer systems are generally 64-bit, which allows for much bigger numbers by default. The maximum possible value is of course still finite, so any computer system is assuming that it will eventually be turned off and on again. But if a 64-bit system counts milliseconds, it will not hit that limit until 584.9 million years ha...

The universe has given us only two units of time: the year and the day. Everything else is the creation of humankind to try to make life easier.

As the protoplanetary disk congealed and separated into the planets as we know them, the Earth was made with a certain amount of angular momentum, sending it flying around the sun, spinning as it goes. The orbit we ended up in gave us the length of the year, and the rate of the Earth’s spin gave us the length of the day. Except they don’t match. There is no reason they should! It was just where the chunks of rock from that protoplanetary disk happened to fall, billions of years ago. The yearlong orbit of the Earth around the sun now takes 365 days, 6 hours, 9 minutes, and 10 seconds. For simplicity, we can call that 365¼ days. This means that, if you celebrate New Year’s Eve after a year of 365 days, the Earth still has a quarter of a day of movement before you’ll be back to exactly where you were last New Year’s Eve. The Earth is tearing around the sun at a speed of around 30 kilometers every second, so this New Year’s Eve you will be over 650,000 kilometers away from wherever you were last year. So, if your New Year’s resolution was to not be late for things, you’re already way behind.

This goes from being a minor inconvenience to becoming a major problem because the Earth’s orbital year controls the seasons. The Northern Hemisphere summer occurs around the same point in the Earth’s orbit every year because this is where the Earth’s tilt aligns the north toward the position of the sun. After every 365-day year, the calendar year moves a quarter of a day away from the seasons. After four years, summer would start a day later. In less than four hundred years, within the lifespan of a civilization, the seasons would drift by three months. After eight hundred years, summer and winter would swap places completely. To fix this, we had to tweak the calendar to have the same number of days as the orbit. Somehow, we needed to break away from having the same number of days every year, but without having a fraction of a day; people get upset if you restart the day at a time other than midnight. We needed to link a year to the Earth’s orbit without breaking the tie between a day and the Earth’s rotation. The solution that most civilizations came up with was to vary the number of days in any given year so there is a fractional number of days per year on average. But there ...

In 46 BCE Julius Caesar decided to fix this with a new, predictable calendar. Every year would have 365 days—the closest whole number to the true value—and the bonus quarter days would be saved up until every fourth year, which would have a single bonus day. The leap year with an extra leap day was born! To get everything back into alignment in the first place, the year 46 BCE had a possible-world-record 445 days. In addition to the bonus month between February and March, two more months were inserted between November and December. Then, from 45 BCE onward, leap years were inserted every four years to keep the calendar in sync. Well, almost. There was an initial clerical error, by which the last year in a four-year period was double-counted as the first year of the next period, so leap years were actually put in every three years. But this was spotted, fixed, and by 3 CE, everything was on track.

Despite all these improvements, our current Gregorian calendar is still not quite perfect. An average of 365.2425 days per year is good, but it’s not exactly 365.2421875. We’re still out by twenty-seven seconds a year. This means that our current Gregorian calendar will drift a whole day once every 3,213 years. The seasons will still reverse once every half a million years. And you will be alarmed to know that there are currently no plans to fix this!

But astronomy does give Julius Caesar the last laugh. The unit of a light-year, that is, the distance traveled by light in a year (in a vacuum) is specified using the Julian year of 365.25 days. So we measure our current cosmos using a unit in part defined by an ancient Roman.

At 3:14 a.m. on Tuesday, January 19, 2038, many of our modern microprocessors and computers are going to stop working. And all because of how they store the current date and time. Individual computers already have enough problems keeping track of how many seconds have passed while they are turned on; things get worse when they also need to keep completely up-to-date with the date. Computer timekeeping has all the ancient problems of keeping a calendar in sync with the planet plus the modern limitations of binary encoding. When the first precursors to the modern internet started to come online in the early 1970s, a consistent timekeeping standard was required. The Institute of Electrical and Electronics Engineers (IEEE) threw a committee of people at the problem, and in 1971 they suggested that all computer systems could count sixtieths of a second from the start of 1971. The electrical power driving the computers was already coming in at a rate of 60 Hertz (vibrations per second), so it simplified things to use this frequency within the system. Very clever. Except that a 60-Hertz system would exceed the space in a 32-digit binary number in a little over two years and three months. Not so clever. So the system was recalibrated to count the number of whole seconds since the start of 1970. This number was stored as a signed 32-digit binary number, which allowed for a maximum of 2,147,483,647 seconds: a total of over sixty-eight years from 1970. And this was put in place by me...

I remember a boozy night out on February 13, 2009, with some friends to celebrate 1,234,567,890 seconds having passed, at just after 11:31 p.m. My programmer friend Jon had written a program to give us the exact countdown; everyone else in the bar was very confused as to why we were celebrating Valentine’s Day half an hour early.

The largest value you can store in a signed 64-bit number is 9,223,372,036,854,775,807, and that number of seconds is equivalent to 292.3 billion years. It’s times like this when the age of the universe becomes a useful unit of measurement: 64-bit Unix time will last until twenty-one times the current age of the universe from now—until (assuming we don’t manage another upgrade in the meantime) December 4 in the year 292,277,026,596 CE, when all the computers will go down. On a Sunday.

Once we live in an entirely 64-bit world, we are safe. The question is: will we upgrade all the multitude of microprocessors in our lives before 2038? We need either new processors or a patch that will force the old ones to use an unusually big number to store the time. Here is a list of all the things I’ve had to update the software on recently: my lightbulbs, a TV, my home thermostat, and the media player that plugs into my TV. I am pretty certain they are all 32-bit systems. Will they be updated in time? Knowing my obsession with up-to-date firmware, probably. But there are going to be a lot of systems that will not get upgraded. There are also processors in my washing machine, dishwasher, and car, and I have no idea how to update those. It’s easy to write this off as a second coming of the Y2K “millennium bug” that wasn’t. That was a case of higher level software storing the year as a two-digit number, which would run out after 99. With a massive effort, almost everything was updated. But a disaster averted does not mean it was never a threat in the first place. It’s risky to be complacent because Y2K was handled so well. Y2K38 will require updating far more fundamental computer code and, in some cases, the computers themselves.

If you want to see the Y2K38 bug in action for yourself, find an iPhone. This may work for other phones, or the iPhone may one day be updated to fix this. But for now, the built-in stopwatch on the iPhone piggybacks on the internal clock and stores its value as a signed 32-bit number. The reliance on the clock means that, if you start the stopwatch and then change the time forward, the time elapsed on the stopwatch will suddenly jump forward. By repeatedly moving the time and date on your phone forward and backward, you can ratchet up the stopwatch at an alarming rate, until it hits the 32-bit limit and crashes.

How hard can it be to know what date it is? Or will be? I could safely state that 64-bit Unix time will run out on December 4 in the year 292,277,026,596 CE because the Gregorian calendar is very predictable. In the short term, it is super easy and loops every few years. Allowing for the two types of year (leap and normal), and the seven possible days a year can start on, there are only fourteen calendars to choose from. When I was shopping for a 2019 calendar (non–leap year, starting on a Tuesday), I knew it would be the same as the one for 2013, so I could pick up a secondhand one at a discount price. Actually, for some retro charm, I hunted down one from 1985. If you care about the sequence of years, the Gregorian calendar loops perfectly every four hundred years after a complete cycle of meta–leap years (the cycle of leaping leap years). So the day you are enjoying now is exactly the same as the day it was four hundred years ago.

GOOD LUCK EVERYONE!!! This year, December has 5 Mondays, 5 Saturdays, and 5 Sundays. This happens once every 823 years. This is called money bags. So share it and money will arrive within 4 days. Based on Chinese feng shui. The one who does not share will be without money. Share within 11 minutes of reading. Can’t hurt so I did it. JUST FOR FUN. This is one of many popular internet memes claiming that something happens only every 823 years. I have no idea where the number 823 came from. But for some reason, the internet is rife with claims that the current year is special and that this specialness will not be repeated for 823 years. Now you can safely reply and say that nothing in the Gregorian calendar can happen less frequently than once every four hundred years. JUST FOR FUN. And, given that there are only four possible month lengths and seven different starting days, there are actually only twenty-eight possible arrangements for the days of a month. So stuff like this actually happens every few years. (Not based on Chinese feng shui.)

In February 2007, six F-22s were flying from Hawaii to Japan when all their systems crashed at once. All navigation systems went offline, the fuel systems went, and even some of the communication systems were out. This was not triggered by an enemy attack or clever sabotage. The aircraft had merely flown over the International Date Line.

If you’re finding it hard to get your head around this, you’re not alone. The International Date Line causes all sorts of confusion, and whoever was programming the F-22 must have struggled to work it out. The US Air Force has not confirmed what went wrong (only that it was fixed within forty-eight hours), but it seems that time suddenly jumped by a day and the plane freaked out and decided that shutting everything down was the best course of action. Midflight attempts to restart the system proved unsuccessful so, while the planes could still fly, the pilots couldn’t navigate. The planes had to limp home by following their nearby refueling aircraft.

While resonance is great in some situations, engineers often have to go to a lot of effort to avoid it in machines and buildings. A washing machine is incredibly annoying in that brief moment when the spin frequency matches the resonance of the rest of the machine: it takes on a life of its own and decides to go for a walk.

Resonance can affect buildings as well. In July 2011, a thirty-nine-story shopping center in South Korea had to be evacuated because resonance was vibrating the building. People at the top of the building felt it start to shake, as if someone had banged the bass and turned up the treble. Which was exactly the problem. After the official investigators had ruled out an earthquake, they found the culprit was an exercise class on the twelfth floor. On July 5, 2011, they had decided to work out to Snap!’s “The Power,” and everyone jumped around harder than they usually did. Could the rhythm of “The Power” match a resonant frequency of the building? During the investigation, about twenty people were crammed back into that room to re-create the exercise class and, sure enough, they did have the power. When the exercise class on the twelfth floor had “The Power,” the thirty-eighth floor started shaking around ten times more than it normally did.

One of the first bridges to be destroyed by synchronized pedestrians was a suspension bridge just outside Manchester, England (in what is now the city of Salford). I believe that this Broughton Suspension Bridge was the earliest bridge destroyed when people walked over it at the resonant frequency. Unlike the Millennium Bridge, which had a feedback loop to synchronize the pedestrians, on Broughton Bridge the people crossing it had to do all the work themselves. The bridge was built in 1826, and people crossed it with no problem at all until 1831. It took a troop of soldiers all marching perfectly in sync to hit the resonant frequency. The 60th Rifle Corps of seventy-four soldiers were heading back to their barracks at about midday on April 12, 1831. They started to cross in rows of four and pretty quickly noticed that the bridge was bouncing in rhythm with their steps. This was apparently quite a fun experience and they started to whistle a tune to go with the bouncing. Until about sixty soldiers were bouncing on the bridge at once and it collapsed. Around twenty people sustained injuries from the sixteen-foot fall into the river; luckily, nobody died. The discussion during the aftermath identified the vibrations as having put the bridge under a greater load than the same number of people standing still would have. Similar bridges were scrutinized; the knowledge of this type of failure was now out there. Thankfully, it did not take loss of life for humans to learn about th...

This is a common theme in human progress. We make things beyond what we understand, as we always have done. Steam engines worked before we had a theory of thermodynamics; vaccines were developed before we knew how the immune system works; aircraft continue to fly to this day, despite the many gaps in our understanding of aerodynamics. When theory lags behind application, there will always be mathematical surprises lying in wait. The important thing is that we learn from these inevitable mistakes and don’t repeat them.

The twisting action of the bridge has since become known to engineers as “torsional instability,” which means that a structure has the capability to twist freely in the middle. I think of torsional instability as the movement no one expects. Most structures don’t have the right combination of size and length to twist noticeably, so torsional instability is forgotten about until a new construction dips just below the threshold where it manifests and then, suddenly, it’s back!

Scientific notation just takes that a step further. In normal language, we like round multiples of millions and billions, but in science, the decimal point is moved all the way to the front, and then the number of digits is specified. So the age of the universe is 1.38E+10. That E is actually a lazy way of writing an exponential: the universe is 1.38 × 1010 years old. For a very small measurement, a negative number is used for the size. A proton has a mass of 1.67E−27 kg. That’s much neater than writing 0.00000000000000000000000000167 kg.

I would be happier if we called them “phone digits” instead of “phone numbers,” because, I repeat, I don’t think they are numbers. If you’re ever not sure if something is a number or not, my test is to imagine asking someone for half of it. If you asked for half the height of someone 180 centimeters tall, they would say 90 centimeters. Height is a number. Ask for half of someone’s phone number, and they will give you the first half of the digits. If the response is not to divide it but rather to split it, it’s not a number.

Thankfully, on the tenth human chromosome is the gene that encodes for the production of this enzyme. The gene has the catchy name of MARCH5, and if you think that looks a lot like a date, then you can already see where this is going. Over on your first chromosome, the gene SEP15 is busy making some other important protein. Type those gene names into Excel and they’ll transform into 5-Mar and 15-Sep, encoded as 3/5/2019 and 9/15/2019 (or whatever the current year is) in the Formula Bar of the US version. All mention of MARCH5 and SEP15 has been obliterated. Do biologists use Excel much to process their data? Is the phosphoglycan C-terminal?! Yes! (Well, I think it is. It was that or “Do BPIFB1 genes secrete in the woods?!” but I wasn’t confident about that one either. I’m way beyond my limit of biological knowledge trying to look up even obvious microbiology things.) Look: the point is yes. Cell biologists use Excel a lot. In 2016 three intrepid researchers in Melbourne analyzed eighteen journals that had published genome research between 2005 and 2015 and found a total of 35,175 publicly available Excel files associated with 3,597 different research papers. They wrote a program to autodownload the Excel files, then scan them for lists of gene names, keeping an eye out for where they had been “autocorrected” by Excel into something else. After checking through the offending files manually to remove false positives, the researchers were left with 987 Excel spreadsheets (fro...

Another limitation of spreadsheets as databases is that they eventually run out. Much like computers having trouble keeping track of time in a 32-digit binary number, Excel has difficulty keeping track of how many rows are in a spreadsheet. In 2010 WikiLeaks presented The Guardian and The New York Times with 92,000 leaked field reports from the war in Afghanistan. Julian Assange delivered them in person to the Guardian offices in London. The journalists quickly confirmed that they seemed to be real but, to their surprise, the reports ended abruptly in April 2009, although they should have gone through to the end of that year. You guessed it: Excel counted its rows as a 16-bit number, so there was a maximum of 216 = 65,536 rows available. So when the journalists opened the data in Excel, all the data after the first 65,536 entries vanished. New York Times journalist Bill Keller described the secret meeting where this was noticed and how “Assange, slipping naturally into the role of office geek, explained that they had hit the limits of Excel.”

Excel does have one good layer of mistake prevention when someone is typing in a formula: it checks that all the syntax is correct. In normal computer programming, you can easily leave a spare bracket somewhere or miss putting in a comma. Which leaves you swearing loudly at a semicolon at 3 a.m. (“What the heck are you doing there?”), or so I’ve heard. Excel at least does a cursory check that all your punctuation is in order.

A final warning from finance. In 2012 JPMorgan Chase lost a bunch of money; it’s difficult to get a hard figure, but the agreement seems to be that it was around $6 billion. As is often the case in modern finance, there are a lot of complicated aspects to how the trading was done and structured (none of which I claim to understand). But the chain of mistakes featured some serious spreadsheet abuse, including the calculation of how big the risk was and how losses were being tracked. A Value-at-Risk (aka VaR) calculation gives traders a sense of how big the current risk is and limits what sorts of trades are allowed within the company’s risk policies. But when that risk is underestimated and the market takes a turn for the worse, a lot of money can be lost.

Amazingly, one specific Value-at-Risk calculation was being done in a series of Excel spreadsheets with values having to be manually copied between them. I get the feeling it was a prototype model for working out the risk that was put into production without being converted to a real system for doing mathematical modeling calculations. And enough errors accumulated in the spreadsheets to underestimate the VaR. An overestimation of risk would have meant that more money was kept safe than should have been, and because it was limiting trades, it would have caused someone to investigate what was going on. An underestimation of VaR silently let people keep risking more and more money. But surely these losses would be noticed by someone. The traders regularly gave their portfolio positions “marks” to indicate how well or badly they were doing. As they would be biased to underplay anything that was going wrong, the Valuation Control Group (VCG) was there to keep an eye on the marks and compare them to the rest of the market. Except they did this with spreadsheets featuring some serious mathematical and methodological errors. It got so bad that an employee started their own ghost spreadsheet to try to track the actual profits and losses.

The JPMorgan Chase & Co. Management Task Force did eventually release a report about the whole shemozzle. Here are my favorite quotes about what happened: This individual immediately made certain adjustments to formulas in the spreadsheets he used. These changes, which were not subject to an appropriate vetting process, inadvertently introduced two calculation errors, the effects of which were to understate the difference between the VCG mid-price and the traders’ marks. (p. 56) Specifically, after subtracting the old rate from the new rate, the spreadsheet divided by their sum instead ...

I find that incredible. Billions of dollars were lost in part because someone added two numbers together instead of averaging them. A spreadsheet has all the outward appearances of making it look as if serious and rigorous calculations have taken place. But they’re only as trustworthy as the formulas below the surface. Colle...

There is something called the Euler characteristic of a surface, which describes the pattern behind how different 2D shapes can join together to make a 3D shape. In short, a ball has a Euler characteristic of two, and hexagons on their own cannot make a shape with a Euler characteristic of more than zero.

When the space shuttle Challenger exploded shortly after launch on January 28, 1986, killing all seven people aboard, a presidential commission was formed to investigate the disaster. The commission included Neil Armstrong, Sally Ride, and Nobel Prize–winning physicist Richard Feynman. The Challenger exploded because of a leak from one of the solid rocket boosters. For takeoff, the space shuttle had two of these boosters, each of which weighed 650 tons and, amazingly, used metal as fuel: they burned aluminum. Once the fuel was spent, the boosters were jettisoned by the shuttle at an altitude of over 25 miles and eventually deployed parachutes so they would splash down into the Atlantic Ocean. Reuse was the name of the shuttle game, so NASA would send boats out to collect the boosters and take them off to be reconditioned and refueled. As they slammed into the ocean, the boosters were basically empty tubes. They were built with a perfectly circular cross section, but the impact could distort them slightly, as could transporting them on their sides. As part of the refurbishment, they were dismantled into four sections, checked to see how distorted they were, reshaped into perfect circles, and put back together. Rubber gaskets called O-rings were placed between the sections to provide a tight seal. It was these O-rings that failed during the launch of Challenger, allowing hot gases to escape from the boosters and start the chain of events that led to its destruction. Famously...

This type of mistake is so common that the programming community has a name for it: an OBOE, or an off-by-one error. Named after the symptom and not the cause, most off-by-one errors come from the complications of convincing code to run for a set number of times or count a certain number of things. I’m obsessed with one specific species of off-by-one error: the fence-post problem. Which is the second weapon in TheJosh’s arsenal. This mistake is called the fence-post problem because it is quintessentially described using the metaphor of a fence: if a fifty-meter stretch of fence has a post every ten meters, how many fence posts are there? The naive answer is five, but there would actually be six.

When it comes to measuring time, we use a weird mix of counting posts and counting the sections of the fence. Or we can look at it in terms of rounding. Age is systematically rounded down: in many countries, a human is age zero for the first year of their life and increments to being one year old only after they have finished that whole period of their life. You are always older than your age. When you are thirty-nine, you are not in your thirty-ninth year of life but your fortieth. If you count the day of your birth as a birthday (which is hard to argue against), then when you turn thirty-nine, it is actually your fortieth birthday. True as that may be, in my experience, people don’t like it written in their birthday card.

Marcus Vitruvius Pollio was a contemporary of Julius Caesar, and we know of him largely through his extensive writing about architecture and science. Vitruvius’s works were very influential in the Renaissance, and Leonardo da Vinci’s Vitruvian Man is named after him. In the third book of his De architectura, he talks about good temple building (including always using an odd number of steps, so when someone places their dominant foot on the first step, they will use the same foot when they reach the top). He also talks about an easy mistake to make when positioning your columns. For a temple twice as long as it is wide, “those who built twice the number of columns for the temple’s length seem to have made a mistake because the temple would then have one more intercolumniation than it should.” In the original Latin, as well as having the columns as columnae, Vitruvius talks about the intercolumnia, or the spaces between the columns. Doubling the length of the temple does not need twice as many columns but, rather, twice as many between-column spaces. Vitruvius is warning those building a temple not to make a fence-post mistake and end up with one column too many. If anyone can find an older example of a fence-post mistake, or any off-by-one error, I’d love to hear about it.

The problem continues to inconvenience people. At five p.m. on September 6, 2017, mathematician James Propp was in a Verizon Wireless phone store in the US, buying a new phone. It was for his son, and thankfully, it came with a no-questions-asked refund policy if returned within fourteen days. As it turns out, the phone was not what his son was after, so two weeks later, on September 20, Propp senior went back to return it. But despite it being less than fourteen days since he had bought the phone, the store could not complete the return, as it was now technically day fifteen of the contract. It seems that Verizon started counting at day one and not at day zero and they used the day number as a way to measure the passing of time. So as soon as James received the phone, Verizon already figured he’d owned it for a whole day. By the start of day two, in Verizon’s system he’d had the phone for two days, even though he’d only received it about seven hours before, and so on and so on, eventually leading to James holding a phone he’d had for less than fourteen days and Verizon claiming he’d owned it for fifteen.

In the United States, ZIP codes are five digits long and go from 00000 to 99999: a total of just a hundred thousand options. Given that the US has a total land surface area of 9,158,022 square kilometers, this gives just under 100 square kilometers per potential ZIP code. They can never be more accurate than that (on average). This does help narrow down the delivery of mail, but the rest of the address is needed for finer resolution.

My favorite recycled-phone-number story comes from the Ultimate Fighting Championship. The UFC is a mixed-martial-arts competition, which I am vaguely aware of only because the fighting ring is an octagon and directly referred to as such. I’d say calling a television show Road to the Octagon and then just showing a bunch of fighters is false advertising. And don’t get me started on how few higher polygons were in Beyond the Octagon. Welterweight UFC fighter Rory MacDonald noticed that whenever he walked out before a fight they would not play the walkout song he requested. His opponents were picking aggressive songs to get them in the mood, and these were being played, but his choices seemed to be disregarded. I imagine that trying to get in the zone before a fight is not helped by the unexpected blasting of MC Hammer’s “U Can’t Touch This.” Other fighters were making fun of his music choices. This persisted until, one day before a fight, the producer came up to Rory and apologized for not being able to play the Nickelback song he had requested. Rory claimed he had never asked for such a thing and the producer showed him the text messages where he had. An old phone number of Rory’s had been recycled and accidentally given to a UFC fan who had been happily picking Rory’s music for him. It’s a great story about the limitations of number combinations and the first recorded time Nickelback caused someone to stop suffering.

Gandhi is famous as a pacifist who led India to independence from the United Kingdom. But since 1991, he has also gained a reputation as a warmonger leader who launches unprovoked nuclear strikes. This is because of the Civilization computer games, which have sold over 33 million copies. They pit you against several world leaders from history in a race to build the greatest civilization, one of whom is the normally peace-loving Gandhi. But ever since early versions of the game, players noticed that Gandhi was a bit of a jerk. Once he developed atomic technology, he would start dropping nuclear bombs on other nations. This was because of a mistake in the computer code. The game designers had deliberately given Gandhi the lowest non-zero aggression rating possible: a score of 1. Classic Gandhi. But later in the game, when all the civilizations were becoming more, well, civilized, every leader had their aggression rating dropped by two. For Gandhi, starting from 1, this calculation played out as 1 − 2 = 255, suddenly setting him to maximum aggression. Even though this error has since been fixed, later versions of the game have kept Gandhi as the most nuke-happy leader as a tradition. The computer was getting an answer of 255 for the same reason computers have trouble keeping track of time: digital memory is finite. The aggression ratings were stored as an 8-digit binary number. Starting at 00000001 and counting down two gave 00000000 and then 11111111 (which is 255 in normal ...

There are ways to mitigate rollover errors. If programmers see a 256 problem coming, they can put a hard limit in place to stop a value going over 255. This happens all the time, and it’s fun spotting people getting confused by the seemingly arbitrary threshold. When messaging app WhatsApp increased the limit on how many users can be in the same group chat from 100 to 256, it was reported in the Independent that “it’s not clear why WhatsApp settled on the oddly specific number.” A lot of people did know why, though. That comment quickly disappeared from the online version, with a footnote explaining that “A number of readers have since noted that 256 is one of the most important numbers in computing.” I feel sorry for whoever was staffing their Twitter account that afternoon. I call this the “brick-wall solution.” If you’re in a WhatsApp group with 256 people (you and 255 friends) and you try to add a 257th person, you will simply be stopped from doing so. But given that you’re pretty much claiming to have 255 better friends, the newbie is probably too tenuous an associate to take it personally. The threat of a rollover error is also why the game of Minecraft has a maximum height limit of 256 blocks—an actual brick-wall solution.

The most dangerous 256 error I have found so far occurred in the Therac-25 medical radiation machine. This was designed to treat cancer patients with bursts of either an electron beam or intense X-rays. It was able to achieve both types of radiation from the one machine by either producing a low-current electron beam, which the patient was directly exposed to, or a high-current electron beam, which was aimed at a metal plate to produce X-rays. The danger was that the beam of electrons required to produce X-rays was so powerful that it could do severe damage to patients if it hit them directly. So if the electron beam’s power was increased, it was vital to make sure that the metal target and a collimator (a filter to shape the X-ray beam) had been placed in between the electron beam and the patient. For this, and a host of other safety reasons, the Therac-25 looped through a piece of setup code, and only if all the systems were verified as being in the correct settings could the beam be turned on. The software had a number stored with the catchy name of Class3 (that’s just how creative programmers can be when naming their variables). Only after the Therac-25 machine had verified that everything was safe would it set Class3 = 0. To make sure that it was checked every time, the setup loop code would add one to Class3 at the beginning of each loop so it started at non-zero. A subroutine with the slightly better name of Chkcol would activate whenever Class3 was not zero and the...

On January 17, 1987, in Yakima Valley Memorial Hospital in Washington (now Virginia Mason Memorial), a patient was due to receive eighty-six rads from a Therac-25 machine (the rad is an antiquated unit of radiation absorption). Before the patient was to receive the dose of X-rays, however, the metal target and collimator had been moved out of the way so the machine could be aligned using normal visible light. They were not put back. The operator hit the Set button on the machine at the exact moment Class3 had rolled over to zero, Chkcol was not run, and the electron beam fired with no target or collimator in place. Instead of eighty-six rads, the patient may have received around 8,000 to 10,000 rads. He died in April that year from complications because of this radiation overdose.

The fix to the software was disturbingly simple: the setup loop was rewritten so it would set Class3 to a specific non-zero value each time instead of incrementing its previous value. It’s a sobering thought that neglecting the way co...

On February 25, 1991, in the First Gulf War, a Scud missile was fired at the US Army barracks near Dhahran, Saudi Arabia. This was not a surprise for the army, which had set up a Patriot missile defense system to detect, track, and intercept any such missiles. Using radar, the Patriot would detect an incoming missile, calculate its speed, and use that to track its movements until an antimissile could be fired to annihilate it. Except a mathematical oversight in the Patriot code meant that it would miss. Originally designed as a portable system to intercept enemy planes, the Patriot battery had been updated in time for the Gulf War so that it could defend against the much faster Scud missiles, which could travel at blistering speeds of around 3,800 mph. The Gulf War Patriots were also placed in static positions instead of being moved around a lot as they had been designed to be. Remaining stationary meant that the Patriot systems were not routinely turned on and off (this, as we have already seen, can lead to some issues with internal timekeeping). The system used a 24-digit binary number (3 bytes) to store the time in tenths of a second since it was last turned on, meaning it could run for 19 days, 10 hours, 2 minutes, and 1.6 seconds before there would be a rollover error. Which must have seemed a long time when they were being designed.