Mars Polar Lander

NASA · United States · Lander · 1999 · The losing decadeFailure

Lost on 3 December 1999 with no descent telemetry, and never found. The review board's probable cause is a spurious touchdown signal at leg deployment that shut the engine off at about 40 m.

TL;DR· 15 min read

Mars Polar Lander reached the Martian atmosphere on 3 December 1999 and was never heard from again. A cost-driven project decision meant it sent no telemetry during entry, descent and landing, so nothing was recorded. The JPL Special Review Board's probable cause is a spurious touchdown signal, generated when the landing legs deployed at about 1,500 m, that was latched in memory and shut the engines off once the touchdown logic was enabled at 40 m. The lander fell the rest of the way and hit at around 22 m/s.

Mars Polar Lander was to set down on the layered terrain near the Martian south pole, dig into it and find out what the ice and dust there record about the planet's climate. It reached the atmosphere on 3 December 1999 and nothing was ever heard from it again, because a cost-driven project decision meant it sent no telemetry at all during entry, descent and landing. The review board's probable cause is cruelly simple. A magnetic sensor in each landing leg twitched when the legs snapped open at around 1,500 m, the flight software recorded the twitch as a touchdown, and the moment the touchdown logic was enabled at 40 m altitude it shut the engines off. The lander fell the rest of the way.

altitude at which the descent engines are believed to have shut down
40 maltitude at which the descent engines are believed to have shut down
resulting impact speed, against a design touchdown of about 2.4 m/s
22 m/sresulting impact speed, against a design touchdown of about 2.4 m/s
bits of telemetry sent during entry, descent and landing, by deliberate project decision
0bits of telemetry sent during entry, descent and landing, by deliberate project decision
A Kennedy Space Center technician looks over the assembled Mars Polar Lander in the Spacecraft Assembly and Encapsulation Facility 2, with the white conical backshell resting above it and the solar panels spread open to either side in their deployed position.
Mars Polar Lander in the clean room at Kennedy Space Center, shortly before it was sealed inside the backshell that carried it to Mars. NASA/KSC, image KSC-98PC-1610

Mars Polar Lander was built to answer a question about ice. Near the Martian south pole, below about 73 degrees south, the ground is layered, alternating bands of clean and dust-laden ice that may hold a readable record of the planet's climate going back a long way. The lander was to come down at the edge of that terrain in late southern spring, when the seasonal carbon dioxide frost had gone and the Sun never sets, and spend ninety days digging into it. Its main instrument package, MVACS, gave it a two-metre arm with a scoop and a camera, a stereo imager on a mast, a weather station and a small oven that would bake soil samples and sniff what came off. A descent camera would photograph the ground on the way down. Russia's Space Research Institute supplied a LIDAR to profile dust and ice hazes overhead, and tucked inside it was a microphone paid for by the Planetary Society, which would have been the first attempt to hear Mars. The whole thing launched on 3 January 1999 at 20:21:10 UTC and cruised for eleven months, with two hitchhiking penetrators, Deep Space 2, bolted under the solar panels of its cruise stage.

It flew into a programme in crisis. Mars Climate Orbiter, its twin in every organisational sense, was lost on 23 September 1999, which cost the lander its primary radio relay and bought it a review board. The Climate Orbiter's mishap board wrote its first report explicitly to improve this landing, and JPL threw people at the problem: a Mission Safety and Success Team of more than fifty senior engineers built a fault tree for the entry, descent and landing sequence, and a Red Team tracked every open item. The fault tree found it. Premature triggering of the touchdown sensor appears in the analysis before the landing. The description of the software design and testing that Lockheed Martin supplied at the time, the board later recorded, "did not leave any concerns in the mind of the MSST." Meanwhile the navigation picture was getting worse rather than better: a fresh set of entry statistics on 10 November 1999 stretched the landing ellipse to about 138 km by 5.4 km, considerably longer than planned for, though still inside what the spacecraft was thought able to handle.

What happened on 3 December 1999 has to be reconstructed entirely from the ground, because the lander sent nothing. The project had adopted a rule that no money would be spent on anything not directly contributing to landing safely, and descent telemetry does not help you land. Headquarters and JPL management agreed. So the record ends at about 20:10 UTC Earth-received time, when the spacecraft should have hit the atmosphere at roughly 6.9 km/s, and picks up again at 20:39, when the first signal from the surface should have arrived and did not. Everything in between is inference. The board's reconstruction runs like this. The parachute opened, the heatshield went, and at about 1,500 m, still hanging under the chute, the three landing legs snapped down into position. Each leg carries a Hall effect magnetic sensor whose job is to notice the instant the footpad touches Mars, so the engines can be killed within 50 milliseconds and the lander not topple. Deploying the legs jolts those sensors, and they emit a brief false pulse. Everyone knew this. The software was supposed to ignore it.

It did not ignore it, because of a gap in the paperwork rather than a mistake in the code. The requirement that touchdown data should not be used until the lander was low enough had been written, but it never flowed into the software requirements specification, and it was never on the list of things to verify during system testing. So the designers wrote logic that read the sensors at 100 Hz and latched a touchdown after two consecutive true readings. Measured leg-deployment transients ran from 5 to 33 milliseconds, and anything at 20 milliseconds or more always latched. The board's judgement was that "it is almost a certainty that at least one of the three would have generated a spurious touchdown indication that the software accepted as valid." The latched state was never reset. About a minute later, at 40 m above the surface and 13 m/s, the radar switched off and the touchdown logic was enabled. The software checked, found a touchdown already recorded and a healthy sensor, and commanded thrust termination. The lander fell 40 m, about the height of a thirteen-storey building, and hit at around 22 m/s against a design speed of 2.4. There is one detail that makes this hurt more: on 4 June 1998 a system-level leg deployment test had been run with the flight software active, and it saw nothing, because the sensors were miswired thanks to an error in a wiring drawing. The legs were rewired. The deployment test was not repeated.

Nobody has ever found it. Mars Global Surveyor's camera photographed more than 300 square kilometres of the landing region at 1.5 metres per pixel starting on 16 December 1999, a resolution at which the lander is one or two pixels and the parachute maybe four, and three separate teams came up empty. In May 2005 the camera team announced a candidate: a bright parachute-like smudge, a dark patch of blast-cleared ground, a bright dot in the middle of it. They spent six attempts through 2005 trying to hit that spot with a higher-resolution technique, succeeded on 27 September, and published the result on 17 October under the headline that the lander had not been found. The parachute was an illuminated hillside; the dot was a single noisy pixel that did not reappear. As of 23 August 2026 the site of Mars Polar Lander remains unknown. The consequences of the loss ran well past the mission. The board's flat verdict that omitting descent telemetry was "a defensible project decision, but an indefensible programmatic one" is why every Mars lander since has screamed its way down, sending tones or telemetry through an orbiter for exactly this reason. The touchdown-sensor fault was corrected in the Mars 2001 lander's software, and that lander's hardware eventually reached Mars in 2008, rebuilt, as Phoenix. The Casani report also named the shape of the failure rather than just its mechanism: a project asked to deliver a lander for roughly half the cost of Mars Pathfinder, staffed so thinly that many key technical areas rested on one person, with engineers working 60 and sometimes 80 hour weeks. "Peers working together," it recommended, "are the first and best line of defense against errors."

Mission facts

Launch

3 January 1999, 20:21:10 UTC (3:21:10 p.m. EST), on a Delta II 7425 from Launch Complex 17, Cape Canaveral Air Station. The mishap board records that the two Mars Surveyor '98 spacecraft used Pads A and B of Complex 17; Jonathan McDowell's launch catalogue puts Mars Polar Lander on SLC-17B, vehicle serial D265, and Mars Climate Orbiter on 17A.↗

Mass

About 583 kg at launch per NSSDCA, made up of 64 kg of hydrazine, an 82 kg cruise stage, a 140 kg aeroshell and heatshield, the two 3.5 kg Deep Space 2 microprobes and the lander itself at about 290 kg. The mishap board's own mission chart gives 576 kg for the same launch, so both numbers circulate.↗

Spacecraft

A hexagonal aluminium honeycomb base on three legs, 1.06 m tall and about 3.6 m wide deployed, carried to Mars inside a 2.4 m aeroshell scaled down from the Mars Pathfinder design. Terminal descent used twelve pulse-modulated 266 N hydrazine engines in three clusters of four, with no throttle valve. Guidance came from an inertial measurement unit and a four-beam Doppler radar.↗

Instruments

Three investigations plus a microphone. MVACS combined a 2 m robotic arm with a digging scoop, arm camera and temperature probe, a stereo imager on a 1.5 m mast, a meteorology package and a thermal and evolved gas analyser. MARDI was to photograph the descent from heatshield jettison at about 8 km. A LIDAR from Russia's Space Research Institute was to profile dust and ice hazes, and the Planetary Society's Mars Microphone rode inside it.↗

Target

The edge of the south polar layered terrain, quoted by the project as 76 degrees south, 195 degrees west (165 east). The landing latitude was 75 S at launch and was moved to 76 S during cruise. The site selection ellipse was about 85 km by 5.4 km (2 sigma); by the final targeting decision, with updated navigation and atmosphere models, it had grown to about 138 km by 5.4 km.↗

Landing sequence as designed

Entry at about 6.9 km/s and 125 km altitude, parachute at roughly 8.8 km and 490 m/s, heatshield jettison about 110 seconds before landing, legs deployed while still on the parachute, radar altitude lock at about 2.5 km, backshell separation and powered descent from about 1.3 km at 80 m/s, and, per NSSDCA, a 2.4 m/s terminal descent phase beginning at 12 m altitude. The mishap board's own descent chart instead labels touchdown 2.5 m/s; the 2.4 m/s used throughout this entry is the JPL review board's figure. The whole descent lasted about five and a half minutes.↗

Arrival timeline

On 3 December 1999, a turn to entry attitude at about 20:04 UTC, cruise stage jettison at about 20:05, atmospheric entry at about 20:10 and expected touchdown at about 20:15. The first signal was expected at 20:39 UTC and never arrived. All of these are Earth-received times; one-way light time was about 14 minutes, so the events at Mars, if they happened, happened about 14 minutes earlier.↗

No descent telemetry

A project rule that no resources would be spent on anything that did not directly contribute to landing safely meant MPL transmitted nothing during entry, descent and landing. Headquarters and JPL management concurred. The review board's verdict: "The decision not to have EDL telemetry was a defensible project decision, but an indefensible programmatic one."↗

Probable cause, as written

"In fact, the probable cause of the loss of MPL has been traced to premature shutdown of the descent engines, resulting from a vulnerability of the software to transient signals. Owing to the lack of data, other potential failure modes cannot positively be ruled out. Nonetheless, the Board judges there to be little doubt about the probable cause of loss of the mission."↗

The mechanism

Each of the three legs carried a Hall effect magnetic sensor to detect touchdown, so the engines could be cut within 50 milliseconds of contact and the lander not tip over. Deploying the legs at about 1,500 m produced a brief false signal from those sensors, a known characteristic. The software was required to ignore it, but the requirement was never written down in a form that flowed into the software specification, so the transient was latched as a valid touchdown. When the touchdown logic was enabled at 40 m, the shutdown command went out.↗

The numbers behind the bug

The sensors were sampled every 10 milliseconds and two consecutive true readings latched a touchdown. Measured leg-deployment transients on development and flight hardware ranged from about 5 to 33 milliseconds; anything at or above 20 milliseconds always latched. Two thermal-vacuum deployment tests on a Mars 2001 lander gave transients of 12, 26.5 and 7.3 milliseconds, then 16, 12 and 25 milliseconds, and the board assessed that both tests would have caused a premature shutdown.↗

Timing within the descent

Leg deployment was complete at entry plus 4 minutes 13 seconds. The 40 m altitude gate arrived at about entry plus 5 minutes 16 seconds. The gap between the false signal and the moment it did damage was roughly one minute.↗

Impact speed

The board's failure-mode table and the summary of section 7.7.2 both give about 22 m/s (50 mph), from 13 m/s at 40 m accelerated by Martian gravity. The detailed walkthrough later in the same section says "approximately 20 meters per second." This entry uses 22 m/s because that is the figure the board carried into its own conclusions, but the two numbers sit a few pages apart in one document. Design touchdown speed was 2.4 m/s.↗

The test that would have caught it

A system-level leg deployment test was run on 4 June 1998 with the flight software active. Nothing was detected, including when technicians pushed up on the footpads. The Hall effect sensors turned out to be wired incorrectly because of an error in the wiring drawing. The legs were rewired, the footpad test passed, and the deployment test was never repeated.↗

How the bug was found

By accident, months after the loss, during a test of the Mars 2001 lander. An engineer pressed a touchdown button too early, realised his mistake and released it, and was surprised when thrust termination happened anyway. The failure analysis that followed uncovered the latched indicator state. The Mars 2001 software was corrected to reset it.↗

The search

Mars Global Surveyor's camera began imaging the landing region at 1.5 metres per pixel on 16 December 1999, eventually covering more than 300 square kilometres and the great majority of the expected landing area. At that scale the lander would be one or two pixels. Three independent organisations found no conclusive evidence. A candidate announced on 5 May 2005 was retracted on 17 October 2005 after an image taken on 27 September 2005 with the cPROTO technique, at an effective resolution better than 1 metre per pixel, showed the bright "parachute" to be a sunlit hillside and the "lander" to be image noise.↗

Mission timeline

  1. 3 Jan 199920:21:10 UTC: Launch on a Delta II 7425 from Launch Complex 17, Cape Canaveral, with the two Deep Space 2 microprobes riding on the cruise stage.
  2. 23 Sep 1999Mars Climate Orbiter is lost during orbit insertion. Mars Polar Lander loses the relay it was designed to talk through, ten weeks before its own arrival, and falls back on Mars Global Surveyor and a direct-to-Earth link.
  3. 10 Nov 1999The Mars Climate Orbiter mishap board publishes sixteen recommendations aimed squarely at saving this lander, including verifying units throughout, auditing every file passed between JPL and Lockheed Martin, and building a fault tree for the rest of the mission. The same day, revised entry statistics give a 3-sigma entry flight path angle of 0.94 degrees and a landing ellipse grown to about 138 km by 5.4 km.
  4. 23 Nov 1999JPL's Red Team, set up to track every open item between the orbiter's loss and this landing, presents its final report.
  5. 1 Dec 1999The Mission Safety and Success Team, more than fifty senior JPL engineers, publishes its final report. Its fault tree had identified premature triggering of the touchdown sensor as a possible failure mode, but the description of the software design and testing supplied at the time left the team unconcerned.
  6. 3 Dec 199920:04 UTC Earth-received: an 80 second thruster firing turns the spacecraft to entry attitude. 20:05: the cruise stage is jettisoned, and about 18 seconds later the two Deep Space 2 probes are meant to separate from it. 20:10: atmospheric entry at about 6.9 km/s. This is the last moment anyone can say anything about with confidence, because there is no telemetry from here on.
  7. 3 Dec 199920:15 UTC Earth-received: touchdown was due. 20:39 UTC: the first signal from the surface was due, opening a 45 minute session. Nothing is received, then or in a planned session at 04:30 UTC on 4 December.
  8. 16 Dec 1999Mars Global Surveyor begins imaging the landing region at 1.5 metres per pixel, hunting for the lander or its 6 m parachute among some 150 million pixels per frame. JPL appoints the Special Review Board the same day.
  9. 17 Jan 2000The flight team announces that recovery efforts have concluded. Commands are sent again in late January and February on the strength of a faint signal reported by Stanford, later traced to the Stanford receiver itself.
  10. 22 Mar 2000The JPL Special Review Board, chaired by John Casani, publishes its report: premature descent engine shutdown from a latched spurious touchdown signal is the probable cause, and the absence of entry, descent and landing telemetry is condemned as an indefensible programmatic decision.
  11. 5 May 2005The Mars Orbiter Camera team announces a candidate site: a bright feature resembling a parachute, a dark patch consistent with rocket-blasted soil and a small bright dot at its centre, all found in January 2000 imagery and re-examined against the Mars Exploration Rover landing sites.
  12. 17 Oct 2005The same team retracts it, after a cPROTO image acquired on 27 September 2005 at better than 1 metre per pixel: "We conclude that our interpretation of these features was in error. This is NOT the location of the Mars Polar Lander." The parachute was a sunlit hill and the lander was a noisy pixel. No candidate has replaced it.

A filled dot marks something that physically happened. A hollow one marks an announcement, a naming or a target.

In pictures

A close look at the lander before encapsulation, solar panels spread open and the deck wrapped in thermal blanket. Credit: NASA/KSC, image KSC-98PC-1349.
Liftoff from Cape Canaveral on 3 January 1999, the last time anyone saw the spacecraft. Credit: NASA/KSC.

Tap a photo to enlarge.

Sources

Facts on this page were verified on 23 August 2026. Where sources disagree, the disagreement is stated rather than resolved silently.

165.0000 E, -76.0000 N · Planum Australe · position estimated, never confirmed from orbit

← Mars Climate Orbiter (1999)The Mars hardware with no ride (2000) →All Mars missions →Mars numbers and data →azmth Mars: the planet →