A 125-million-dollar spacecraft lost over a few pounds

Pasadena, 23 September 1999: the control room was waiting for a signal that should have come back out from behind Mars, and it never did. Mars Climate Orbiter was a spacecraft built to study the Martian climate and it had cost around 125 million dollars: the price of the craft alone, without the rocket or the nine months of control from the ground. It was lost because one program wrote the impulse of its thrusters in pound-force seconds and another read it as newton seconds.

A few minutes before the silence, the probe had fired its main engine to brake. It was arriving too fast to stay in orbit around Mars: it had to shed speed and let the planet's gravity capture it. During the manoeuvre it was due to pass behind the Martian disc, and the antennas on Earth were going to lose the signal along that stretch and pick it up again on the far side.

The planned trajectory was taking it to about 226 kilometres above the surface, a little over half the height at which the International Space Station circles the Earth. The calculations reconstructed afterwards put the real pass at close to 57. The structure could not survive below about 80. At that height, the Martian atmosphere could have torn it apart through heating and aerodynamic forces, or bounced it into an orbit nobody could recover.

Weeks before that engine burn there was already a clue. The navigators at the Jet Propulsion Laboratory, NASA's centre in Pasadena that runs its robotic missions, could see that the calculated trajectories did not quite match the measured position. They said so. There were conversations between specialists and attempts to understand why small corrections were producing an effect different from the expected one. Nobody opened a formal anomaly report, the document that would have forced them to log the problem, assign it owners and chase it until it was closed.

Each individual deviation looked tiny. The small thrusters fired for an instant to desaturate the reaction wheels, the flywheels that point the spacecraft without spending fuel, and those firings happened between ten and fourteen times more often than the navigation team had expected. The ground software written by Lockheed Martin, the contractor that built the probe in Denver, measured the impulse of those nudges — force multiplied by how long it lasts — in pound-force seconds. The JPL navigation software took the number and treated it as newton seconds. One pound-force is 4.45 newtons: every firing entered the books 4.45 times smaller than it had actually been. The board that investigated the accident, the Mars Climate Orbiter Mishap Investigation Board, published the first part of its report on 10 November and shared out the blame between two teams that nobody had ever required to check which units they were speaking in.

Nine months earlier the difference had not yet had time to build up. The probe left Cape Canaveral, the Florida launch base, on 11 December 1998 and travelled for 286 days. Firing by firing, that bookkeeping error slowly bent the arrival corridor.

The interface specification had called for newton seconds from day one; the ground software never met it. Seventy-one days after losing the orbiter, on 3 December 1999, NASA also lost Mars Polar Lander, the sister module of the same programme, launched three weeks later to set down on the surface; that one crashed for a different reason.