A coordinate without its system is not a location

A file contains the numbers −2.0 and 53.0. That is not a location. It is a pair of numbers which becomes a location once four other things are known, and three of them are usually absent from the file.

The four things #

A datum, which is the model the numbers are about: its shape, where it sits relative to the Earth’s centre of mass, and which marked points realise it. What a coordinate refers to is the whole essay on that, and its consequence here is that a latitude is a statement about an ellipsoid rather than about the ground.

An epoch, because the ground moves. The epoch is part of the coordinate measures plate motion at up to 70 millimetres a year, which is 1.75 metres over a working lifetime and enough to matter on a datum realised at a stated date.

Units and axis order, which sound like clerical matters and are the two largest failures in this essay.

And an identifier, so that all of the above travels with the numbers. That a registry of such identifiers exists is the practical answer; that most files do not carry one is why this essay has content.

The datum readings, and why they are the dangerous ones #

Read against the three published datums, the point at 2° west, 53° north lands 102.9, 137.8 and 194.8 metres from where WGS84 puts it. Those come from seven-parameter Helmert transformations through geocentric Cartesian coordinates, and the site’s gate requires the round trip to close to under a millimetre before any of them is printed.

A hundred metres is the dangerous magnitude, and it is worth saying why. It is far too large for any survey purpose — thirty times a chain’s own closing tolerance, on the numbers what a tape measures works through. It is far too small to look wrong: the point is still in the right town, on the right side of the right river, and every sanity check a human would apply passes.

Datum shifts dwarf projection errors makes the comparison that gives this its proportion: the difference between two datums is one to two orders of magnitude larger than the difference between two reasonable projections of the same region, and it is the one nobody argues about.

The horizontal picture leaves out a third of the shift. A datum change moves a point in three dimensions and the height component is routinely the largest of the three — a fact invisible to anybody treating a coordinate as a pair of numbers on a map.

The axis swap, and the line where it hides #

Reversing longitude and latitude is the mistake everyone has met and nobody worries about, because the result is usually absurd: 53° east, 2° north is in the Arabian Sea, 7,942 kilometres from a point in England.

The magnitudes elsewhere are similar. At 0°E 60°N the swap moves the point 8,390 kilometres; at 70°W 40°N, 14,872; at 12°E 52°N, 5,701. Any of those would be caught by a glance at a map.

Except on the diagonal. Where longitude equals latitude the two numbers are the same and reversing them does nothing at all — measured as under $10^{-6}$ metres, which is the assertion’s way of saying exactly nothing. And near the diagonal the displacement is small: for a swap to move a point by more than a kilometre it must be at least

so the band inside which a swapped coordinate is within a kilometre of its true position is roughly 1.3 hundredths of a degree wide, and it runs from the Gulf of Guinea through the Sahara, the eastern Mediterranean, the Balkans and central Asia.

That band is a curiosity rather than a hazard — a swapped coordinate is unlikely to land in it — but the reasoning it refutes is not a curiosity at all. “An axis swap is obvious” is a claim that a check by eye is sufficient, and the correct statement is that a check by eye catches the mistake everywhere except on a set that can be described exactly. Which is what a measurement is for.

Two conventions, both official, in opposite orders #

The swap is not simply carelessness. Two conventions are in genuine conflict.

The geodetic tradition writes latitude first: a position is quoted as 53° north, 2° west, in that order, and the registry entry for the geographic system says the axes are latitude then longitude.

The computing tradition writes x first, and on any projected system x is the easting, so a coordinate pair is horizontal then vertical: longitude then latitude. Every plotting routine, every geometry library and every interchange format built on the idea of a point as $(x, y)$ inherits it.

Both are internally consistent and neither is wrong. What produces the failure is that the identifier travels — the system is named — while the order does not, so two programs agreeing perfectly on which datum is meant can still disagree about which number is which. That is what a grid is made of at one further remove: five declarations a coordinate does not carry, and this is the sixth.

Reading degrees as metres #

The last failure is the units, and it is the one that produces the famous cluster of points off the coast of West Africa.

A coordinate of −2.0, 53.0 read as metres on a projected grid is two metres west and fifty-three metres north of that grid’s origin. On a national grid with a false origin the result is somewhere odd but within the country’s frame; on a system whose origin is the intersection of the equator and the prime meridian, it is in the Atlantic, 570 kilometres south of Ghana, and every dataset in the world that has ever suffered the mistake has a point there.

The magnitude is a factor of about 111,000 — the metres in a degree — which is why this mistake is never subtle. It is the opposite of the datum case: too large to be plausible, therefore caught immediately, therefore harmless. The units are part of the coordinate has the version that is not harmless, where the two units differ by two parts per million and a coordinate is wrong by three metres in a way nothing detects.

The unit confusion at the other end of the scale does not announce itself either. Two definitions of the foot differing by two parts per million, over a coordinate of a million and a half units, give a discrepancy of three metres — and over a site three hundred feet across, four hundredths of a millimetre. The mistake is invisible locally and large in absolute position, which is the exact opposite of reading degrees as metres.

How much of the world the range check actually covers #

The first of the four checks is the cheapest and it is the one whose coverage is easiest to overstate. Latitudes outside ±90 are not latitudes catches a swapped pair only when the longitude, arriving in the latitude field, exceeds 90 in magnitude. Where it does not, the swapped pair is a perfectly well-formed coordinate and nothing about its arithmetic complains.

Over a dataset spread uniformly by area over the sphere, exactly half the points are caught, because half the sphere lies within 90° of the prime meridian. That is a reassuring number and it is the wrong one for almost every real dataset, because real datasets are not spread over the sphere.

The half-world the check cannot see is the band from 90° west to 90° east, and its contents decide the matter:

• the whole of Europe and Africa, which span about 25° west to 45° east — not one point of either is caught;
• the whole of the Middle East, India and western Asia;
• every part of South America, whose westernmost point is near 81° west, and every part of North America east of the Rockies — so a dataset of the conterminous United States is caught only west of about 90° west, which is roughly half of it, and a dataset of Brazil is never caught at all.

What the check does catch is East Asia, Australia, the Pacific and the eastern Atlantic beyond 90° west — which is to say it works best exactly where the world’s coordinate data is thinnest.

So the check’s power is a property of where the data is and not of the check. A European dataset gains nothing from it whatever; a global one gains half; and no amount of care in implementing it changes either figure. That is worth stating beside the check rather than after it, because a validation step that passes tells a reader something only if its coverage is known, and this one is habitually described as though it caught the failure rather than half of it.

The second check — plausibility against a stated extent — is what actually does the work, and the reason is the complement of the same argument: an extent is a statement about where the data should be, so it is exactly the external information the range check lacks. A European dataset with a declared bounding box catches every swap, because 53° of longitude against a box ending at 45° is outside it even though 53 is a valid latitude. A check gains its power from the declaration it is compared against, not from the arithmetic it performs, which is the essay’s own thesis about identifiers arriving one level down, in the validation rather than in the file.

And it is why the fourth check is the one that matters for the middle of the table. A datum offset is inside any plausible extent, inside every range, and invariant under every internal consistency test — so the only declaration that could catch it is one about the ground, and the ground is not in the file.

The ordering of the four failures #

Collecting them by size, which is the useful way to hold them:

The pattern is not that some failures are worse. It is that the failures nothing catches are the small ones, and the small ones are exactly the sizes at which coordinates are worth having. A dataset good to a metre is ruined by a 100-metre datum error and unaffected by a 5,000-kilometre one, because the second gets fixed on the day it happens.

That is the argument for carrying the identifier. Not because the large mistakes are dangerous — they are self-correcting — but because the ones in the middle of the table are indistinguishable from correct data by every means except knowing what the numbers refer to.

One failure has a clock in it. Plate motion carried over twenty-five years, measured from rigid-plate rotation rather than quoted, puts a coordinate correct at its epoch and used without one up to 1.75 metres wrong — and the error grows every year the dataset sits unchanged.

One further asymmetry follows from the same geography and points the other way. The band the range check cannot see is centred on the prime meridian, which is where it is because of a decision made in 1884 about a telescope in Greenwich. Had the zero of longitude been placed in the Pacific — which was seriously proposed, and which is where the date line ended up — the uncatchable half would have been the empty half, and this check would work almost everywhere that data exists. The coverage of a validation rule is therefore a consequence of a nineteenth-century committee, which is not a fact anybody would predict and is exactly the kind of thing this ladder exists to notice.

Why no check on the file can find the middle of the table #

The datum failure is undetectable from inside the data, and the reason is a property of the transformation rather than a shortage of ingenuity.

A datum shift is a Helmert transformation: three translations, three small rotations and a scale. That is a similarity — it preserves shape exactly and changes size by one factor — so a dataset shifted from one datum to another has the same angles everywhere and the same distances up to a single multiplier. Every internal consistency check passes, because nothing internal has changed.

What does change is measurable if there is an external length standard. The OSGB36 transformation carries a scale term of −20.49 parts per million and rotations of up to 0.84 arcseconds, so a ten-kilometre line comes out 20 centimetres shorter and a long bearing rotates by a fraction of a second. Those are the traces, and reading them requires knowing what the line’s length actually is — which is a measurement, not a check.

The seven parameters of a datum transformation divide unevenly. The three translations dominate, the scale term is twenty parts per million and the rotations are under an arcsecond — and those last four are exactly what a three-parameter shortcut leaves out, which on one measured point is twenty-seven metres of it.

The identifier is a claim, and it moves #

Carrying a code with the numbers is the right answer and it is not a complete one, because the thing a code names has a history.

A datum is realised by a set of marked points with published coordinates, and the set is re-observed. Successive realisations of the same named system differ — by metres in the early ones, by centimetres in the modern ones — so two files both correctly labelled with the same code can disagree by more than the precision either of them claims. A published coordinate is a result is the essay on that: a control coordinate is held fixed by convention, so re-observing disagrees and both are right.

There is a second version of the same problem in the transformations. The essays on datums measure it directly: a seven-parameter fit over a lopsided network absorbs part of the network’s own strain into its scale term, so two authorities fitting the same pair of datums over different sets of markers publish different parameters and neither is mistaken. Where a fit leaves residuals has the measurement — 1.44 parts per million of fitted scale moving when the markers are cut to a wedge — and the consequence here is that even the transformation between two named systems is not unique.

So the honest statement is a chain: the numbers need a system, the system needs a realisation, and converting between realisations needs a transformation that is itself a choice. Each link is a convention and each has a measured size.

What a check would look like #

The site’s habit is to give every claim a test it could fail, and the same discipline can be applied to a file of coordinates. Four checks, each computable from the numbers alone:

Range. Latitudes outside ±90 are not latitudes, which catches the axis swap for any point beyond 90° of longitude — a majority of the inhabited world, and none of Europe or Africa.

Plausibility against a known extent. A dataset with a stated area of interest can be tested against it; this catches the units failure and most swaps.

Round-trip through a transformation. Applying a datum shift and its inverse must return the original to under a millimetre, which is the assertion this site’s own library carries and which catches a transformation applied in the wrong direction.

And a second source. No arithmetic on a file can detect a systematic hundred-metre datum offset, because the file is entirely self-consistent. That failure is only visible against something else — another dataset, a control point, an image — which is why a published coordinate is a result matters here: the fixed points a system is realised by are the only external reference there is.

What the same numbers do at a different place #

The sizes in this essay are not constants, and quoting them as though they were is the mistake the site’s parameterisation rule exists to prevent. The same four readings, taken in central Europe at 8° east, 47° north, come out at 216.2, 131.7 and 204.3 metres for the three datums and 5,687 kilometres for the swap.

The ordering has changed. OSGB36 is now the largest of the three rather than the smallest, which is exactly what a datum fitted to a region does when it is used outside that region — the argument of a datum is fitted to a region, arriving here as a number that doubles when the point moves eight hundred kilometres.

That is the reason the figure takes the location as a parameter rather than drawing one place. A caption reading the shifts are around a hundred metres would be true in England and wrong in Switzerland, and the version of this figure that hardcoded its point would have said so with equal confidence at both.

Where this ladder goes #

The rest of this ladder is about operations rather than about identity: what a program computes when it is handed geometry, and what each computation assumed. The first of them is the smallest and the most common — a distance written in degrees, which is not a distance at all.