Mars Observer

Mars Observer was supposed to be the cheap one. Between 1981 and 1983 the Solar System Exploration Committee of the NASA Advisory Council proposed it as the Mars Geoscience/Climatology Orbiter, the first of a series of planetary missions that would buy their science by adapting proven Earth-orbit satellite buses instead of designing new spacecraft from scratch. Approval came for a fiscal year 1985 start. JPL managed the project and picked a bus derived from the Defense Meteorological Satellite Program and the Satcom K commercial communications satellites, built by RCA Astro-Electronics, a company that became General Electric Astro-Space and then Martin Marietta Astro Space while the spacecraft was still being assembled. Over eight years of development the plan came apart in slow motion. Funding was cut, the payload was redefined more than once, the follow-on missions were cancelled, and the launcher moved from the Space Shuttle to a Titan III. The failure board's own summary of the net effect is blunt: the schedule stretched by two years, the launch vehicle changed, and the cost roughly doubled. NSSDCA puts the final total at $813 million. What actually flew on 25 September 1992 was still a serious machine, carrying a camera, a laser altimeter, a thermal emission spectrometer, a gamma ray spectrometer, an infrared radiometer, a magnetometer and electron reflectometer, a radio science investigation and a French-built relay meant to talk to a Russian lander. It was also the first American launch to Mars since Viking, seventeen years earlier.

The cruise was almost boring, which is the highest compliment available in deep space. Only three of the four planned trajectory correction manoeuvres were needed to hit the aim point. The one recurring problem was the inertial reference flight software, which faulted eleven times, five of them badly enough to drop the spacecraft into Contingency Mode; in every case the redundancy management software did its job, turning the solar array to the Sun and switching telemetry to the low gain antenna, and a July 1993 patch to the star identification code was expected to close the matter. On 4 August 1993 JPL began loading the Mars orbit insertion sequence, and the last parameters went up on 20 August. Insertion was a set of seven manoeuvres, the first of them on 24 August, and it started by pressurising the propellant tanks with helium admitted through two pyrotechnic valves. Because the pyro shock might damage the travelling wave tubes in the radio, the mission's flight rules called for the transmitter and power amplifier to be switched off for the ten minutes of the pressurisation block. Add four minutes for the tubes to warm back up and the plan was a fourteen minute silence, something already done several times in flight. The transmitter went off at 00:21 UTC on 22 August. Telemetry stopped on cue at 00:40 UTC. At 00:54 UTC it did not come back, and because the radio was off there is no telemetry at all from the moment the spacecraft died.

Daniel Goldin appointed Timothy Coffey of the Naval Research Laboratory to chair a failure board on 10 September 1993. Without telemetry the board could not find a fault, only eliminate candidates. It built roughly sixty failure scenarios across six subsystems and ran them through four filters: could the failure kill the downlink immediately, could it be something other than a random event (the failure had to land inside one specific fourteen minute window), could it silence the spacecraft for days rather than seconds, and could it be tied to the pressurisation sequence, which contained commands being executed for the first time in the mission. Whatever survived was then tested. The board's first principal conclusion states plainly that it never found a smoking gun. By elimination it named the most probable cause as a massive failure of the pressurisation side of the propulsion system, most probably because nitrogen tetroxide and monomethyl hydrazine mixed in the titanium pressurisation tubing. The proposed mechanism is quietly horrifying in its smallness. The oxidiser tank was isolated by two check valves in series, and for much of the cruise the plumbing beyond them was cold. JPL tests on identical valves, extrapolated across eleven months, suggested one to two grams of oxidiser could migrate through with no valve failure whatever. The board then calculated that burning less than a tenth of a gram of it against the fuel would release enough energy to melt a centimetre of the tubing.

The board's other two conclusions were about people rather than hardware. It judged the spacecraft design generally sound and the organisation that produced it not: the system had failed to react to a programme that had changed radically from the one originally envisioned, and far too much weight had been placed on heritage. Its list of specific concerns names the trap directly, calling out unjustified reliance on check valves with only Earth-orbital heritage for a job that demanded flawless leak-proof performance for eleven months in the cold and in free fall, and noting that propulsion redundancy had been removed after the switch from the Shuttle to the Titan. It also refused to eliminate three other candidates: a short circuit on the regulated power bus, a regulator failure rupturing a tank, and a NASA Standard Initiator ejected from a pyro valve like a bullet. Attempts that September to detect the Mars Balloon Relay's independent beacon with volunteered radio telescopes in the United States and Britain failed, and only while the report was being written did anyone realise the relay cannot be switched on in Safe Mode, which controllers had already commanded. So the fate of Mars Observer is genuinely unknown. Its stored sequence may have fired the engine on 24 August and placed a dead spacecraft in Mars orbit, or it may have sailed past into an orbit around the Sun. Nothing has ever been identified.

What followed was the Mars Surveyor Program: smaller spacecraft, launched at every 26-month opportunity, on cheaper rockets, with the explicit intention that no single failure could ever again cost a decade and $813 million. Mars Global Surveyor was the first of them, and it was in the most literal sense Mars Observer rebuilt. Its camera was the actual flight spare manufactured for Mars Observer. Its laser altimeter, thermal emission spectrometer and magnetometer were rebuilds of Mars Observer designs by the same principal investigators. The Gamma Ray Spectrometer went to 2001 Mars Odyssey, again under William Boynton. The infrared radiometer went to Mars Climate Orbiter, which was itself lost in 1999, and its lineage continued to the Mars Climate Sounder still flying on Mars Reconnaissance Orbiter. That is the strange afterlife of this mission. Nothing Mars Observer carried ever saw Mars, and yet almost every instrument on it eventually did, in a second copy, on someone else's spacecraft. The laser altimeter is the clearest case. Rebuilt as MOLA and flown on Mars Global Surveyor, it produced the global height model that the Mars globe on this site is displaced from, pixel by pixel. The map you are looking at exists because a mission that failed had a spare parts list.