In September 1999, a NASA spacecraft that had traveled roughly 416 million miles to reach Mars flew too low into the planet’s atmosphere and was torn apart, ending a mission years in the making. It was not destroyed by an explosion, a hostile planet, or bad luck. It was destroyed by a unit’s error, the same metric-versus-imperial mix-up that strips a bolt in a home garage, except here it cost a spacecraft. One piece of software reported the orbiter’s small thruster firings in imperial pound-force, and the navigation software that read those numbers treated them as metric newtons, a unit about 4.45 times different, so every small nudge over nine months of flight pulled the spacecraft further off course than anyone realized. The units, though, were only the trigger. The deeper failure, the one NASA’s own investigation pointed to, is that the people running the mission had every chance to catch the mistake, and the system around them never forced the catch in time.
The Mission: Mars Climate Orbiter
The Mars Climate Orbiter, originally called the Mars Surveyor ’98 Orbiter, launched on December 11, 1998, atop a Delta II rocket from Cape Canaveral. Lockheed Martin built and operated the spacecraft in Colorado, while NASA’s Jet Propulsion Laboratory managed the mission.
Its job was to study the Martian climate and atmosphere over a full Martian year, mapping seasonal shifts in water vapor, dust, and carbon dioxide ice, and to serve as a communications relay for the Mars Polar Lander that was due to touch down that December.
The orbiter itself cost about $125 million; the 638-kilogram probe and the broader Mars Surveyor ’98 program, the orbiter plus the lander, ran to roughly $327 million. The plan called for the spacecraft to enter a stretched, elliptical orbit and then spend about two months gradually circularizing it by skimming the upper atmosphere, a delicate technique called aerobraking. It was a spacecraft designed to dip carefully into Mars’s air, over and over. The unit’s error sent it in far too steeply on the very first try.
The Units Error That Doomed It
The fault lived in a piece of ground software. After certain routine maneuvers, a Lockheed-built application called SM_FORCES, the “Small Forces” code, calculated the impulse from the spacecraft’s thrusters and wrote the results into a file that the navigation team used to track the orbiter’s path. According to the investigation, that data was required to be in metric units per the existing software interface documentation, and the trajectory modelers assumed it was.
It was not. The code output the values in pound-force-seconds rather than newton-seconds, and because one pound-force equals about 4.45 newtons, the navigation processing underestimated the effect of the thruster firings by a factor of 4.45.
The popular version of this story blames Lockheed for stubbornly using imperial units, and that is too simple.
The interface specification called for metric, so the code did not meet its own requirement, and on the receiving end, JPL’s navigators assumed the conversion had already been made and never verified it. Neither side validated the handoff end-to-end. As one engineering analysis of the disaster put it, the loss was not a novel physics problem at all. It was an interface-control and verification failure in which a valid-looking number carried the wrong unit. The number looked perfectly reasonable. It was simply wrong by a constant factor, every single time.
Why A Tiny Error Grew Enormous
A 4.45 factor sounds like it should have been obvious immediately. The reason it did not come down to the spacecraft’s shape.
The orbiter steered its orientation with spinning reaction wheels, and to keep those wheels from saturating, it periodically fired thrusters in what are called angular momentum desaturation events, or AMDs. The Mars Climate Orbiter needed these far more often than usual because it carried only a single solar panel. That asymmetry meant sunlight pushed unevenly on the spacecraft, and the investigation found it had to desaturate ten to fourteen times more often than the navigation team expected, more than ten times as often as its two-panel sister craft, Mars Global Surveyor.
Each of those firings was tiny, and that is exactly why the error hid for so long. Because the desaturation burns were so low in energy, being off by 4.45 times was hardly noticeable on any single event, so every small maneuver did very little while the trajectory model believed it was doing several times more.
The errors were small individually and pointed the same way every time, so over nine months and hundreds of millions of miles, they quietly compounded, bending the spacecraft’s true path away from the one on the navigators’ screens. By the time it mattered, the gap was large, and the spacecraft was nearly at Mars.
Arrival And The Moment It Was Lost
The orbiter made four planned course corrections en route to Mars, the last on September 15, 1999. There was a fifth, optional correction available one day before arrival that could have nudged the spacecraft to a safer approach, but management declined it because they believed the probe was on course.
It was not on course. The final maneuver had been computed to bring the orbiter around Mars at an altitude of about 226 kilometers. Instead, it arrived far too low, by most estimates around 57 kilometers, well below the roughly 80 kilometers the spacecraft could survive.
On September 23, 1999, the orbiter fired its main engine to enter orbit, then passed behind Mars as seen from Earth.
The signal cut off about 49 seconds earlier than predicted, itself a sign that the spacecraft was coming in too low and too fast. Controllers waited out the expected 21-minute blackout and listened for the orbiter to reappear. It never did. The Mars Climate Orbiter was either destroyed in the upper atmosphere or skipped back out into a solar orbit. Either way, after crossing the solar system, it was gone in minutes.
The Deeper Cause The Investigation Found
NASA’s Mars Climate Orbiter Mishap Investigation Board officially named the units’ mistranslation the root cause.
But the board was careful to say that the unit’s error alone is not the real lesson. Its report noted that sufficient processes are usually in place on projects to catch such mistakes before they become fatal, and that for this mission, those processes failed. The board identified eight contributing factors, including inadequate consideration of the mission as a total system, inconsistent communications and training within the project, and a lack of complete end-to-end verification of the navigation software. It also pointed to insufficient navigation team staffing and training, and to the decision not to perform that final corrective maneuver.
The most telling detail is that the spacecraft told itself, and people noticed. During the spring and summer of 1999, working-level concerns arose about discrepancies between the navigation solutions, with some calculations consistently showing a closer approach to Mars.
Those concerns were raised and never resolved. The board’s chairman, Arthur Stephenson, said when the report came out that the review had identified the factors that allowed the error to take root and then let it linger and propagate to the point where it ruined the team’s understanding of where the spacecraft actually was. The mistake was catchable. The system that was supposed to catch it did not.
The Aftermath And The Real Lesson
The failure landed as one half of a disaster.
The Mars Polar Lander, the very spacecraft the orbiter was meant to relay for, was lost during its descent on December 3, 1999, due to a separate fault, even though managers had cross-checked the orbiter’s problems against the lander’s.
Two spacecraft, lost within weeks, turned 1999 into a catastrophic year for NASA’s Mars program and forced a hard reckoning with the “faster, better, cheaper” philosophy that had pushed missions to do more with less, leaving little margin for the kind of thorough checking that would have caught a unit’s error.
The Mars Climate Orbiter became the textbook example, taught in engineering and software courses around the world, of how a trivial-seeming detail can destroy something enormous. The deeper reason it endures as a lesson is the part most retellings skip.
The danger was never really the conversion mistake, which is the sort of error people make constantly and catch constantly.
The danger was a mission that produced a wrong number, carried it for nine months, generated warning signs along the way, had engineers who noticed those signs, and still could not act on any of it before the spacecraft hit the atmosphere.
The orbiter was not destroyed because someone used the wrong units. It was destroyed because nothing in the system around that mistake was strong enough to stop it.
About the Author: Harry J. Kazianis
Harry J. Kazianis (@Grecianformula) was the former Senior Director of National Security Affairs at the Center for the National Interest (CFTNI), a foreign policy think tank founded by Richard Nixon based in Washington, DC. Harry has over a decade of experience in think tanks and national security publishing. His ideas have been published in the NY Times, The Washington Post, The Wall Street Journal, CNN, and many other outlets worldwide. He has held positions at CSIS, the Heritage Foundation, the University of Nottingham, and several other institutions related to national security research and studies. He is the former Executive Editor of the National Interest and the Diplomat. He holds a Master’s degree focusing on international affairs from Harvard University.
