Mars Climate Orbiter

Mars Climate Orbiter was one half of a two-spacecraft package. NASA's Mars Surveyor Program had settled on a rhythm of launching to Mars every 26 months, and for the 1998 and 1999 window it sent an orbiter and a lander built by the same prime contractor, Lockheed Martin Astronautics of Denver, under the same JPL project office. The orbiter's job was weather. It carried a colour camera for daily global imaging and a pressure modulator infrared radiometer to take the temperature, dust and water vapour of the atmosphere layer by layer, and once it had aerobraked down into a two-hour polar mapping orbit it was to spend a full Martian year watching the planet's climate machine work. It had a second job too, one that turned out to matter more in hindsight than in the plan: it was to be the UHF relay for Mars Polar Lander, passing over the landing site around ten times a Martian day. It launched on 11 December 1998 at 18:45:51 UTC on a Delta II from Cape Canaveral, weighing 629 kg with propellant, and by every account it behaved beautifully. The mishap board later noted that the spacecraft "operated as commanded and the mission was categorized as extremely successful until right before Mars orbit insertion."

The failure lived in a file. Reaction wheels spin up as they absorb disturbance torques, and periodically a spacecraft has to fire thrusters to bleed that momentum off, a manoeuvre called angular momentum desaturation. Those thruster pulses nudge the spacecraft, so navigators need to know exactly how hard each one pushed. On MCO the number came from a ground program named SM_FORCES, which took telemetry from each desaturation, computed a velocity change from the thruster's impulse bit and firing time, and wrote the result into a file the navigation software read. A written software interface specification said the impulse figures in that file would be in newton-seconds. They were in pound-force seconds. One pound-force is 4.45 newtons, so every desaturation was fed into the trajectory model at rather less than a quarter of its true strength. The same calculation was also performed onboard the spacecraft, in metric, correctly. Two features of MCO's design turned a small bookkeeping error into a fatal one. Its single solar array was asymmetric about the body, so solar pressure built up momentum far faster than on the symmetric Mars Global Surveyor, and desaturations occurred 10 to 14 times more often than the navigation team expected. And the thrust was directed mostly across the Earth line of sight, where Doppler tracking could barely see it, and mostly across the flight path, where it pushed the spacecraft sideways towards Mars.

So the error accumulated invisibly, and then it stopped being invisible without anyone being able to say why. From April 1999 the navigation team knew something was wrong with the way the desaturation manoeuvres were being modelled. Through spring and summer, the orbit solutions computed from Doppler data alone kept putting the incoming flight path closer to the planet than the solutions that combined Doppler and ranging. Those concerns went around by email rather than through the project's formal anomaly process, and were never closed out. The final planned correction, TCM-4, was computed on 8 September and flown on 15 September, aiming for a first periapsis of 226 km. Over the following week the estimate slid to 150 to 170 km. About an hour before the insertion burn, with Mars' gravity now clearly bending the trajectory and better data in hand, the number came out as low as 110 km. The altitude the spacecraft could survive was 80 km. A contingency manoeuvre, TCM-5, existed on paper and could have lifted the periapsis, but the analysis and procedures to commit to it had never been finished, the onboard insertion sequence had priority, and it was discussed out loud and never sent. The engine lit at 09:00:46 UTC on 23 September 1999. The carrier vanished at 09:04:52 UTC, 49 seconds early, and never returned. After the fact, with corrected small-force values, the reconstructed closest approach was 57 km.

The board's finding is often quoted as a joke about metric and imperial units, which is a shame, because the report is much harder on itself than the joke is. It named one root cause and eight contributing causes, and the contributing causes are the interesting part: undetected mismodelling of velocity changes, a navigation team unfamiliar with the spacecraft it was flying, TCM-5 not performed, a systems engineering process that did not survive the handover from development to operations, inadequate communication between project elements, inadequate navigation staffing, inadequate training, and a verification and validation process that did not cover ground software. Behind all of them sits a sentence the board wrote plainly: "The Board recognizes that mistakes occur on spacecraft projects. However, sufficient processes are usually in place on projects to catch these mistakes before they become critical to mission success. Unfortunately for MCO, the root cause was not caught by the processes in-place in the MCO project." Its second report, published on 13 March 2000, put the same argument at programme level, finding that Mars Surveyor had accepted deep cuts in money and people without instilling the discipline that would have compensated, and that too many projects were emphasising the faster and cheaper parts of Faster, Better, Cheaper over the better part.

There is one more thing worth saying about the loss. Mars Climate Orbiter was the relay Mars Polar Lander was meant to talk through, so when it died the lander lost its primary communications path ten weeks before arrival and fell back on Mars Global Surveyor and a direct-to-Earth link. It also, more usefully, gained a review board. The Phase I report published on 10 November 1999 was written explicitly to help the lander survive, and its recommendations ran through MPL's remaining weeks: verify the consistent use of units, audit the software for specification compliance on every file passed between JPL and Lockheed Martin, compare navigation solutions by independent methods, prepare properly for a contingency TCM-5, construct a fault tree for the rest of the mission. JPL stood up a Mission Safety and Success Team of more than fifty senior engineers and a Red Team to track the work. None of it saved Mars Polar Lander, and the fault tree those teams built actually contained the failure mode that killed it. But the units problem, the thing everyone remembers, never recurred. Both PMIRR instruments built for Mars were lost before reaching orbit, one with Mars Observer in 1993 and one here. As of 23 August 2026 no debris, impact site or heliocentric trace of Mars Climate Orbiter has ever been identified. The board could only say that it was destroyed in the atmosphere or passed through and out into solar orbit, and twenty-seven years later that is still where the record stands.