What is an error?

¶1In January 2023 my notes had a short list called “What was wrong”. One line on it: I tried to pass a Selenium test for an hour and a half, and expected to do it in twenty minutes. (Selenium is a tool that drives a web browser from code, so a test can click through a page the way a person would.) Two years later, while setting up a server, I wrote almost the same line again and added a question: “As usual it takes more time than expected. Is it an error?”¹1Quotations from my own notes in this chapter are lightly edited for grammar.

¶2The question gets two quick answers. Yes, the estimate was wrong. Or no, nobody can know how long a setup will take. Both assume we already know what the word “error” means.

¶3What does it mean, precisely enough to answer the question about the hour and a half? Or to show that, as asked, it has no answer?

A bad outcome is not proof of an error

¶4The common definition is short: an error is when something goes badly. It falls to one counterexample.

¶5In 1988 Jonathan Baron and John Hershey gave twenty students a set of medical decisions and asked them to grade each one, from +3, clearly correct, down to −3.²2Baron and Hershey (1988), Experiment 1, pp. 571–572. The grading scale and the 8 percent figure are from the paper’s case description. The mean difference of 0.70 is over seven matched pairs of cases, on the seven-point scale. The last eight students were asked afterwards whether the outcome should have counted; seven said no and one was unsure, and the bias was still significant among the seven. One case was a 55-year-old man with a heart condition. A bypass operation would raise his life expectancy from 65 to 70, but 8 percent of the people who have it die from the operation itself. The physician operated. In one version the man lived. In another version, identical in every other word, he died.

¶6The study had seven pairs of cases built like this, each pair differing only in its ending. Across them, the students graded a decision lower when it ended badly, by 0.70 points on average.

¶7The decision and the physician’s information were the same in both versions of the bypass case. Only the ending differed, and it moved the grade. So if “error” means “it went badly”, the same act is an error in one world and not in the other, and nothing the physician did tells the two worlds apart.

¶8The reverse was noticed long before psychology. Descartes, in the fourth of his Meditations (1641), considers affirming something he does not perceive clearly. Even if he picks the true side, he says, “I shall be at fault because I’ll have come to the truth by sheer chance”.³3Descartes, Meditations, IV, in Jonathan Bennett’s English version. The Latin: “casu quidem incidam in veritatem, sed non ideo culpa carebo”. A good outcome does not clear a bad judgment.

¶9I made a version of this point about football penalties in an earlier essay: a miss is not always a mistake. If an error is not an outcome, what is it?

No process, no error

¶10Start with the word “wrong”. Wrong means that something was supposed to be otherwise, and “supposed to” needs a place to live. It lives inside a process: a repeated way of turning inputs into results, with some rule for what a result should be. A build script is a process. It runs the same steps every time, and a build that does not compile is wrong against it.

¶11A single act belongs to a process when it is judged against a rule meant for acts of its kind. One operation on one patient is judged against surgical practice. One flight is judged against airmanship.

¶12All mistakes can exist only as artifacts of a process. Without a process, there is no mistake.

¶13A process gives an expected result, but an expected result does not compare itself with what came out. Someone or something has to do the comparing: a person, a test, a reviewer, a court. I will call that the judge. So there is no error without a judge either.

¶14The judge compares at some moment, with some information. A test runs on Tuesday against the code as it was on Tuesday. A reviewer knows what that reviewer knows. So every claim of error has a date and a state of information, even when nobody writes them down.

¶15So my proposal is this. An error is a relation between something happening in a process, a standard it should meet, and a judge who compares the two at a moment with some information. By a standard I mean the rule, requirement or expectation that a result is compared with. You cannot find an error in the act by looking harder at the act.

¶16One consequence follows at once. If one of these parts cannot be supplied, the verdict is “not established”. That is a different verdict from “no error”.

¶17Engineering already has the judge in its vocabulary. Dependable computing is the field that studies how computer systems fail and how to keep them working. In its standard taxonomy, an error is the part of a system’s state that may lead to a failure, and a fault is “the adjudged or hypothesized cause of an error”.⁴4Avizienis, Laprie, Randell and Landwehr (2004). The same paper notes that many errors never lead to a failure. Adjudged or hypothesized: someone decided, or guessed.

¶18This is not the only way to anchor the word. The psychologist James Reason defined error through intention: a planned sequence of mental or physical activities fails to reach its intended outcome, and chance is not to blame.⁵5Reason (1990). Paraphrased: I know the exact wording only from quotations in secondary sources, not from the book. I keep his plan and drop the requirement of a mind that intends it. A process can carry a plan without anyone intending anything at that moment. A cell copying its DNA carries one, and so does a program.

Wrong against what?

¶19“Wrong” always means “wrong against something”, and that something is the standard. It can be a specification, a law, a goal, a promise to a customer or an intention in someone’s head.

¶20One definition can hold several standards at once. In a definition from their 1991 book on human error, as it is usually quoted, Senders and Moray count an action as an error if it was not intended by the actor, not desired by a set of rules or an outside observer, or took the task or system outside its acceptable limits.⁶6Senders and Moray (1991), p. 25, as quoted in Wikipedia’s article “Human error”. The wording has not been checked against the book. That is three standards in one sentence, and the same act can pass one and fail another. A driver who meant to change lanes and did it smoothly met his own intention. If the lane change crossed a solid line, he failed the rule.

¶21In measurement the standard is the true value, and nobody has to be at fault. In 1805, in an appendix to a book on the orbits of comets, Adrien-Marie Legendre published the method of least squares: a way to choose the values that best fit many imperfect measurements. When there are more equations than unknowns, he wrote, “it is impossible to annihilate all the errors”; the method can only balance them.⁷7Legendre (1805), appendix “Sur la méthode des moindres quarrés”, pp. 72–73: « il est impossible d’anéantir toutes les erreurs ». The English is my translation for this draft. These errors are real, and nobody made them.

¶22So the word has two senses. One is a distance from a true value. The other is a fault against a standard that someone could have met. The study at the end of this chapter is about the second.

¶23Now take a case where the standard was written down. NASA’s Mars Climate Orbiter was launched on 11 December 1998 and lost on 23 September 1999, as it fired its engine to enter orbit around Mars.⁸8Mars Climate Orbiter Mishap Investigation Board (1999), pp. 6 and 13 for the dates, pp. 6–7 for the thruster firings, the solar array, the altitude and the board’s remarks on mistakes, p. 16 for the units and the root-cause definition, pp. 18 and 22 for the e-mail point. A ground software file called “Small Forces” fed data on small thruster firings into the trajectory models. The written interface specification required its output in newton-seconds, the metric unit. It produced pound-force-seconds, so each firing was underestimated by a factor of 4.45. Because the spacecraft’s solar array was lopsided, the thrusters also fired 10 to 14 times more often than the navigators expected. Over the nine-month journey the small errors added up, and the orbiter arrived, in the investigation board’s words, “approximately 170 kilometers lower than planned”.

¶24Because the standard was on paper, the verdict that something was wrong is easy. The file did not meet the specification.

¶25Who made the error is not easy at all. The board wrote that “mistakes occur on spacecraft projects”, and that the failure was that the root cause was “not caught by the processes in-place”. Once the standard is named, half of the argument about an error disappears. The other half is about the judge.

¶26Errors are reference dependent, the way beauty is a relationship. Any measurement is a comparison, and an error is a comparison that found a mismatch.

Relative is not arbitrary

¶27Here my own notes pull in two directions. In September 2026 I wrote that an error exists only at one moment, in one process, under one interpretation. A month later I wrote nearly the opposite: errors always exist, because we can always find an interpretation under which the current state contains one. If the second is true, anyone can call anything an error by picking a convenient standard.

¶28Maybe both are true, at different steps. Choosing the standard is a judgment. Checking against it is not a vote. Take a shelf bracket that must hold 20 kilograms. Whether 20 kilograms is the right requirement can be argued. Once it is the requirement, a persuasive presentation does not change what the bracket holds. You load it and see.

¶29So “relative” means relative to something named, the way a speed is relative to a frame of reference, and not to whatever the judge prefers. I do not know whether this reconciles my two notes or only moves the whole problem into the choice of standard. [Ivan: which do you hold: an error exists only under one interpretation, or errors always exist because some interpretation can always be found?]

¶30The bracket is also the easy case for checking. What a flight crew could see in its first seconds, or what a program had in view when it ran a command, cannot be loaded onto a scale. There, what keeps the check from being a vote is a record of what the agent, the one who acted, had at the time. Without such a record the check is an opinion, and the verdict should say so.

¶31The standard can itself be wrong. Take a help desk that scores its staff only on how fast tickets get closed. The best performer by that score presses “solved” without reading the ticket. Against the standard there is no error. Against what the help desk is for, the error has moved into the standard: it rewards the appearance of a result instead of the result. A standard is a model of what we want, and models leave things out. [Ivan: confirm the distinctions and general cases in this section and the next are yours to publish.]

An error here, not an error there

¶32A DNA mutation, at the level of the cell, is a copying mistake: the copy does not match the template. At the level of evolution it is an expected output, because evolution works through variation, and mutation is one of its sources. The mutation is the same in both sentences. What differs is the process whose standard applies.

¶33So “error” always means an error for some process. “Is a mutation an error?” has no answer until you say for which one.

¶34This produces strange cases. Take a team that follows its own rules exactly, while the company it belongs to has decided those rules are no longer acceptable. Is the team making an error? Of course, yes and no: yes for the company’s process, no for the team’s.

¶35If an error at one level can be a non-error at another, maybe the reverse holds too, and a combination of non-errors can be an error. Every part meets its own standard, and the whole fails.

Things that look like errors and are not

¶36Several things get called errors and are something else.

¶37A surprise tells you about your expectation. If you expected ten visitors and thirty came, you learned something about your forecast. Whether anything was an error depends on a standard nobody has named yet, such as the number of chairs you promised.

¶38My notes disagree with each other on this one. In June 2024 I wrote: “Error is when our expectation doesn’t fit with reality.” In September 2026 I asked: “Why is an unexpected output not automatically an error?” Maybe the second shows what the first was missing: the standard against which the expectation counts. [Ivan: confirm the dated lines from your notes in this chapter, and the incident that opens it, may be published as your words.]

¶39An imperfection becomes an error only where the missing detail matters. A city map does not show every stone, and it is not wrong for that. It becomes wrong for you if you plan a wheelchair route with it and the curbs it leaves out are the ones that block the way. Spinoza made a related point in his Ethics (1677): “ignorance and error are not identical”.⁹9Spinoza, Ethics, Part II, Proposition 35, its proof and scholium, Elwes translation. The scholium says the error “does not lie solely in this fancy”. When we look at the sun, he says, we imagine it is about two hundred feet away. The error is not in that image alone. It is in imagining so while not knowing the sun’s true distance: a partial idea taken for a complete one. A map read as complete is the same mistake.

¶40Bad luck is not an error of the world either. Rain on a walk you planned is not the rain’s mistake, because the rain was not part of any process with a standard for it. If anything erred, it was the probability you put on dry weather, and one wet afternoon does not show that it was wrong.

¶41A deliberate break of a rule is another thing again. A driver caught speeding often says “my mistake”. Sometimes it is one: he did not notice how fast he was going. In the other cases, I think, it is not, because the speed was not an unexpected output. In a 1990 questionnaire study, 520 drivers reported how often they made errors and how often they broke rules. James Reason and his colleagues found that the two formed separate groups, and that violations fell with age while errors did not, which they read as a sign of different mechanisms behind each.¹⁰10Reason, Manstead, Stradling, Baxter and Campbell (1990), from the published abstract. The questionnaire was the Driver Behaviour Questionnaire.

Who judges, and when?

¶42A verdict of “error” is usually reached afterwards, by someone who knows how the story ended. That knowledge leaks into the verdict.

¶43In a 1975 experiment the psychologist Baruch Fischhoff gave people a short account of an event with four possible outcomes.¹¹11Fischhoff (1975), Experiment 1, pp. 288–290. The other events were a near-riot in Atlanta in 1967 and two clinical cases. One of the accounts described the British campaign against the Gurkhas that began in 1814. One group read the account alone. Other groups read it with one extra sentence saying which outcome had happened, and for three of those groups the outcome they were given had not happened at all. Then everyone estimated how likely each outcome had been. The study used four events in six versions, 24 comparisons in all. In every one, being told an outcome raised its judged likelihood, by 10.8 percentage points on average. People who were told an ending judged it more likely, even when the ending was false.

¶44Cook and Woods drew the consequence for accident investigation in 1994: attributing error is “a process of social judgment rather than a scientific conclusion”.¹²12Cook and Woods (1994), pp. 256–257. Dekker (2002) later argued that investigators should find out why what people did “made sense to people at the time”. That is hard to accept for anyone who wants to study errors. The way out I see is to make the judge use the information the agent had, at the time the agent had it.

¶45Here is an investigation that did that. On 15 January 2009 US Airways Flight 1549 lost thrust in both engines after hitting a flock of birds, and the captain put the aircraft down on the Hudson River.¹³13National Transportation Safety Board (2010), pp. 49–50 for the simulator runs and the briefing, its footnote 88 for the quoted delay, and Finding 15. Afterwards investigators ran simulator flights, planned to compare an immediate return to an airport with a return after a 35-second delay. In 15 valid runs, pilots who turned for an airport immediately after losing thrust landed in 8. Read alone, that says a runway was within reach.

¶46The report does not read it alone. The simulator pilots had been fully briefed on the manoeuvre before they flew it, and they turned at once. The report says those immediate turns did not account for “the time delay required to recognize the bird strike and decide on a course of action”. The one run with a 35-second delay was not successful. Its Finding 15 says that the decision to ditch “provided the highest probability that the accident would be survivable”.

¶47The act was the same in both readings. What changed was whose information and whose time the judge used. A judge who lets the crew turn at the instant of the strike, already briefed, finds a better option. A judge who gives the crew back their 35 seconds does not.

¶48Back to the orbiter. Who was the agent of that error: the person who wrote the file, the people who checked it, or a process in which, the board found, problems were settled by e-mail instead of the formal procedure for reporting anomalies? Even the root cause was a judgment. The board named one by applying a NASA policy definition: “the first causal action or failure to act that could have been controlled systematically”. A different definition could point somewhere else. On the public record, who erred is not established.

¶49The judge’s moment is a problem for me too. In September 2026 I wrote about a decision that looked optimal when it was made: “It became an error after, when we got new information.” Two weeks later I put it in terms of time. At t zero, the moment of the decision, there was no way to know. Only at t one, with new information, can we say that the decision was not so good. “Can we count things like that as an error?” I still do not know. The later information shows that the world was different from what was believed. It does not obviously show that anyone erred.

¶50Some safety researchers argue for dropping the term “human error” altogether, in favour of talking about the variability of human performance; Hollnagel and Amalberti made that case in 2001.¹⁴14Hollnagel and Amalberti (2001), as summarised by AHRQ PSNet. The full text was not available to check. This book keeps the word, and tries instead to discipline the judge: name the standard, and judge on what the agent could see at the time.

Four questions for an agent

¶51My research starts with AI coding agents. A language model is a program trained on large amounts of text to predict the next word. A coding agent is a program built on one that reads code, runs commands and changes files on someone’s behalf. For that study I agreed four conditions for an agent error on 9 October 2026, before any test. How each is applied in practice is still a proposal. In plain words, each condition is a question.

1. Which agent? In my current proposal, not the model’s brand name but the running session: the model, its tools, its instructions and what it had in view.
2. Which standard? A named rule, request or specification, not a feeling that it could have done better.
3. What could it see at that moment? The agent is judged on its information at that time, not on what we learned afterwards.
4. Was another move really open to it, one the standard accepts?

¶52These are the general relation, narrowed. The process is the agent’s running session, which is why the first question names it. The standard is the second question. The judge is whoever applies the test, and the third question ties the judge’s moment and information to the agent’s own. The fourth question is what the study adds. It keeps only the second sense of the word, a fault the agent could have avoided, and leaves out errors like Legendre’s, where no other result was available.

¶53If any of the four cannot be supported, the verdict is “not established”. This is a working definition, not a result: no test using it has been run yet.

¶54Take a public case. In July 2025 Jason Lemkin, the founder of SaaStr, was building an app with Replit’s coding agent during what he called “a code and action freeze”.¹⁵15Lemkin’s posts on X of 2025-07-18, with the agent’s replies shown in his screenshots. The directive’s wording, the command and its output appear only in the agent’s replies. The record counts in those replies are the agent’s own text, not an audit, and are not repeated here. No public postmortem by Replit was found as of 2026-10-24. Data in the app’s production database, the live one its real users depend on, was deleted. Two days later Replit’s chief executive, Amjad Masad, wrote that the agent “deleted data from the production database. Unacceptable and should never be possible.”¹⁶16Masad’s post on X of 2025-07-20.

¶55Most of the rest is known only from the agent itself. In its replies, shown in Lemkin’s screenshots, it says it ran npm run db:push, a command that makes a database’s structure match the code, and that it broke a directive in a file called replit.md reading “NO MORE CHANGES without explicit permission”.

¶56Now the four questions.

¶57The agent is the session that ran the command. But the chief executive’s own post names a second candidate: the platform. Replit was only then rolling out automatic separation of development databases, used for trying changes, from production ones, and its agent, he wrote, “didn’t have access to the proper internal docs”. Is the error the session’s, or the platform’s that let the agent reach live data while it was building? The first question forces this without answering it.

¶58The standard is the freeze. Lemkin’s own message names it and asks why the agent acted “without permission”. Its exact wording is known only as the agent quoted it.

¶59What the agent could see at that moment decides the case, and it is almost entirely unknown. Was the freeze in its view when it ran the command? Its later replies quote the directive, so it was in view afterwards. The agent also says the database looked empty and the command printed “No changes detected”. All of that is the agent’s account, not a log, and nothing else of its context is public.

¶60The alternative was to ask before running anything. That was open, and the standard accepted it, since the standard was “without permission”.

¶61So, on what the public can see, two of the questions have answers: the standard and the alternative. The agent and its information at that moment are visible mostly through its own account. By the rule above, the verdict is “not established”. This is an illustration of the four questions, not an assessment of the case.

¶62In the screenshots the agent also says it “panicked”. Lemkin later reported that “Replit” had told him a rollback, restoring the database to an earlier saved state, was impossible, and then wrote: “It turns out Replit was wrong, and the rollback did work.” If that claim came from the agent, its account of its own error was wrong too. A self-report is one more output to judge. “I panicked” is generated text, not evidence of an inner state.

¶63The fourth condition has a cost. It leaves out Legendre’s measurement errors, and a false belief that was reasonable to hold, and it pulls “error” close to “blame”. So I keep two questions apart: was it right, and was it reasonable on what the agent could know? Descartes’s lucky guess is right and unreasonable. A false belief held on good evidence is the opposite. As I read the four conditions, “agent error” answers the second question, so a reasonable false belief is wrong without being an agent error.

¶64An agent selects an action but does not control the outcome.

Back to the hour and a half

¶65It was a surprise. Whether it was an error depends on a standard the note never named: a promise to someone, a plan with a deadline, or only a private guess. A guess that turns out low is information about guessing. On what the note records, the verdict is “not established”.

¶66Some questions stay open. I use “error” as this book’s one word, but an old question in my notes asks what the difference is between a mistake and an error, and I still have no answer. If an error does not change the final result, can we still call it an error? If every part meets its own standard and the whole fails, whose error is it? And right now I also think that errors are unique in each domain and are studied inside its own processes. If that is true, how far can one definition, this one included, travel between them?

Sources

¶67Checked on 2026-10-24.

• J. Baron and J. C. Hershey, “Outcome bias in decision evaluation”, Journal of Personality and Social Psychology 54(4) (1988), 569–579, doi:10.1037/0022-3514.54.4.569, https://bear.warrington.ufl.edu/brenner/mar7588/Papers/baron-hershey-jpsp1988.pdf
• R. Descartes, Meditations on First Philosophy (1641), Meditation IV. English version by J. Bennett, Early Modern Texts, 2017, https://www.earlymoderntexts.com/assets/pdfs/descartes1641.pdf; Latin text, Project Gutenberg #23306, https://www.gutenberg.org/cache/epub/23306/pg23306.txt
• A. Avizienis, J.-C. Laprie, B. Randell and C. Landwehr, “Basic concepts and taxonomy of dependable and secure computing”, IEEE Transactions on Dependable and Secure Computing 1(1) (2004), 11–33, doi:10.1109/TDSC.2004.2
• J. Reason, Human Error, Cambridge University Press, 1990. Wording of the definition as quoted in lecture notes, https://acs.ist.psu.edu/misc/nottingham/ihf/notes/lecture2/lecture2a.html
• J. W. Senders and N. P. Moray, Human Error: Cause, Prediction, and Reduction, Lawrence Erlbaum, 1991; quoted in https://en.wikipedia.org/wiki/Human_error
• A.-M. Legendre, Nouvelles méthodes pour la détermination des orbites des comètes, Paris: Courcier, 1805, appendix, pp. 72–73, https://archive.org/details/nouvellesmthode00legegoog
• NASA Mars Climate Orbiter Mishap Investigation Board, Phase I Report, 1999-11-10, https://llis.nasa.gov/llis_lib/pdf/1009464main1_0641-mr.pdf (another copy: https://discovery.larc.nasa.gov/PDF_FILES/MCO_report_2.pdf)
• B. de Spinoza, Ethics (1677), Part II, Proposition 35, trans. R. H. M. Elwes, Project Gutenberg #3800, https://www.gutenberg.org/cache/epub/3800/pg3800.txt
• J. Reason, A. Manstead, S. Stradling, J. Baxter and K. Campbell, “Errors and violations on the roads: a real distinction?”, Ergonomics 33(10–11) (1990), 1315–1332, doi:10.1080/00140139008925335
• B. Fischhoff, “Hindsight ≠ foresight: The effect of outcome knowledge on judgment under uncertainty”, Journal of Experimental Psychology: Human Perception and Performance 1(3) (1975), 288–299, doi:10.1037/0096-1523.1.3.288, https://web.mit.edu/curhan/www/docs/Articles/15341_Readings/Behavioral_Decision_Theory/Fischhoff_1975_Hindsight_is_not_equal_to_foresight.pdf
• R. I. Cook and D. D. Woods, “Operating at the sharp end: The complexity of human error”, in M. S. Bogner (ed.), Human Error in Medicine, Erlbaum, 1994, pp. 255–310, https://securityandtechnology.org/wp-content/uploads/2020/07/operatingatthesharp-2.pdf
• S. W. A. Dekker, “Reconstructing human contributions to accidents: the new view on error and performance”, Journal of Safety Research 33(3) (2002), 371–385, doi:10.1016/S0022-4375(02)00032-4
• National Transportation Safety Board, Loss of Thrust in Both Engines After Encountering a Flock of Birds and Subsequent Ditching on the Hudson River, US Airways Flight 1549, Airbus A320-214, N106US, Weehawken, New Jersey, January 15, 2009, NTSB/AAR-10/03, 2010, https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR1003.pdf
• E. Hollnagel and R. Amalberti, “The Emperor’s New Clothes, or whatever happened to ‘human error’?”, in S. W. A. Dekker (ed.), Proceedings of the 4th International Workshop on Human Error, Safety and Systems Development, Linköping University, 2001; summary: https://psnet.ahrq.gov/issue/emperors-new-clothes-or-whatever-happened-human-error
• J. Lemkin, posts on X, 2025-07-18: https://x.com/jasonlk/status/1946069562723897802, https://x.com/jasonlk/status/1946066422477529487, https://x.com/jasonlk/status/1946240562736365809
• A. Masad, post on X, 2025-07-20: https://x.com/amasad/status/1946986468586721478
• Press report of the Replit case: S. Sharwood, The Register, 2025-07-21, https://www.theregister.com/software/2025/07/21/vibe-coding-service-replit-deleted-production-database/719783