In 1999, a small unit mismatch sent NASA's Mars Climate Orbiter deep into the Martian atmosphere and led to the failure of the mission

In 1999, a small unit mismatch sent NASA's Mars Climate Orbiter deep into the Martian atmosphere and led to the failure of the mission. The NASA Mars Climate Orbiter was lost on September 23, 1999, during its planned arrival at Mars. The spacecraft had travelled for nine months after launch and its onboard software was working with metric units. The failure came from a ground-software interface. Lockheed Martin software reported thruster impulse in pound-force-seconds, while the NASA navigation system expected newton-seconds. The navigation system therefore calculated only a fraction of the actual effect of repeated thruster firings. The error changed the spacecraft's path and caused it to pass far closer to Mars than planned.

What happened during the Mars Climate Orbiter mission?

At 09:00:46 UTC on September 23, 1999, Mars Climate Orbiter began firing its main engine as planned. About five minutes later, the spacecraft moved behind Mars from Earth's point of view. Its radio carrier disappeared at 09:04:52 UTC. The signal disappeared 49 seconds earlier than mission controllers expected.


A radio blackout was expected because Mars was blocking the spacecraft from Earth. The expected blackout was about 21 minutes. However, the signal did not return. NASA said that morning that the spacecraft appeared to have passed Mars at about 60 kilometres instead of the planned 150 kilometres. That was already below the estimated survival limit.

The Delta II rocket had successfully launched the spacecraft nine months earlier. Mars Climate Orbiter had also completed its journey from Earth. Its orbit-insertion engine started on schedule and the spacecraft followed the commands it received. The problem was that the navigation team did not have an accurate model of the spacecraft's position and trajectory.

The software used two different units

The Mars Climate Orbiter used reaction wheels to control its orientation. These wheels allowed the spacecraft to turn without constantly using thrusters. However, the wheels could build up stored angular momentum. Forces such as sunlight hitting the spacecraft's large, off-centre solar array caused this momentum to increase. Small thruster firings were used to remove the stored momentum. Engineers called these events angular momentum desaturations.

Every thruster firing produced a physical impulse. That impulse changed the spacecraft's velocity by a small amount. The ground navigation team therefore needed to include these effects when calculating the spacecraft's trajectory. The spacecraft's own software calculated the thruster performance in metric units. That part of the system was working correctly.

The problem was in a ground program called SM_FORCES. It produced an Angular Momentum Desaturation file for the navigation team. The interface specification required the file to use newton-seconds. Instead, the software supplied the impulse values in pound-force-seconds. One pound-force-second equals about 4.45 newton-seconds.

The navigation software assumed that the values in the file were already in newton-seconds. It therefore treated each reported impulse as about 22 percent of its actual value. This was the central unit mismatch behind the Mars Climate Orbiter failure.

The common explanation that NASA simply forgot to convert imperial units to metric does not describe the entire problem. The unit had been specified in the interface documentation. The producing software did not follow that specification, while the receiving software did not independently check the units.

Small thruster firings created a large error

One thruster firing was not enough to destroy the mission. The error grew because the firings happened repeatedly. The angular momentum desaturations occurred 10 to 14 times more often than the operations navigation team expected.

The spacecraft had a single off-centre solar array. Sunlight placed continuous torque on the spacecraft. This caused the reaction wheels to reach their limits faster than expected.

The team had earlier considered rotating the spacecraft by 180 degrees each day. This was known as barbecue mode. The manoeuvre was intended to reduce the build-up of angular momentum.

Later engineering work concluded that the manoeuvre was not needed, so it was removed. The Mars Climate Orbiter mishap board found that the consequences of this change were not adequately communicated to the navigation team. More desaturations meant more thruster impulses.

The spacecraft responded to the full physical force of each firing. The ground navigation model accounted for only about one-fourth of the effect. Over the nine-month journey, the actual spacecraft path and the predicted path moved farther apart.

Warning signs appeared months before arrival

The unit problem was not completely hidden until the spacecraft reached Mars. During the first four months of the cruise, the navigation team could not use the Angular Momentum Desaturation files because they contained format errors and incorrect attitude specifications.

Instead, staff received information about the timing of thruster events through email and attempted to model the effects themselves. Corrected-format files became available in April 1999. Within a week, the numbers appeared unusual.

Tracking data also showed residuals. These were differences between the trajectory predicted by the navigation model and the motion observed by the Deep Space Network. The main thrust component was close to perpendicular to the Earth-spacecraft line of sight. This made the complete size of the error harder to identify through Doppler measurements.

The error was not impossible to detect. The investigation found that a measurable line-of-sight error existed, but its significance was not understood. The navigation team had joined the operation shortly before launch. Its members had not participated in the spacecraft design reviews or ground-software testing. They were also not fully familiar with the orbiter's attitude-control behaviour.

Concerns about the trajectory model continued through the spring and summer. However, they were handled through informal communication. The investigation found that teams relied on email instead of the formal Incident, Surprise, Anomaly process. That process could have assigned responsibility and required the issue to be resolved.

The spacecraft was getting closer to Mars

On September 15, Mars Climate Orbiter completed its fourth planned trajectory correction. The manoeuvre was intended to produce a first periapsis of 226 kilometres. Periapsis is the lowest point of an orbit around Mars. A later pass at 210 kilometres was planned to begin controlled aerobraking. The process would use the upper atmosphere to reduce and circularise the orbit.

During the week after the September 15 correction, navigation calculations placed the expected first periapsis between 150 and 170 kilometres. During the final 24 hours, the estimate dropped further. About one hour before orbit insertion, the team calculated that the spacecraft could pass as low as 110 kilometres. The minimum altitude considered survivable was about 80 kilometres.

Different navigation methods also produced different results. Calculations using Doppler data alone placed the spacecraft closer to Mars than calculations using other combinations of range and Doppler data. The disagreement was not resolved before the encounter. A fifth trajectory correction manoeuvre, known as TCM-5, existed as a contingency. It could have raised the spacecraft's altitude.

A request to perform the manoeuvre was discussed verbally shortly before orbit insertion. However, the required analysis, tests and procedures had not been completed. The operations timeline also did not provide enough margin to upload, perform and verify the manoeuvre. The need for the correction was not fully understood. TCM-5 was never performed.

Mars Climate Orbiter reached about 57 kilometres

After the spacecraft disappeared, investigators corrected the small-force data and reconstructed its approach using the tracking information available before contact was lost. The reconstruction placed the first periapsis at about 57 kilometres.

That was about 170 kilometres below the planned 226-kilometre altitude. It was also below the estimated survivable altitude. The reconstruction explained why the radio signal disappeared 49 seconds earlier than expected. The spacecraft was passing closer to Mars than the navigation model had predicted.

The exact physical outcome cannot be established with complete certainty. The 1999 investigation said the spacecraft either was destroyed in the Martian atmosphere or emerged into a heliocentric orbit.

NASA's mission history describes Mars Climate Orbiter as having burned up. What is certain is that it did not enter the intended Mars orbit and NASA never regained contact with it. The loss also affected planned communications support for Mars Polar Lander and the Deep Space 2 microprobes, which were scheduled to arrive at Mars in December 1999.

Mars Global Surveyor was prepared to provide relay support. It could not save Mars Polar Lander, which also disappeared during its arrival. That failure had different and less certain causes.

The investigation found more than a unit error

The Mars Climate Orbiter failure was not attributed to one careless programmer. NASA's investigation identified one root cause and eight contributing causes.

These included:

• Undetected modelling errors
• Limited spacecraft knowledge within the navigation team
• Failure to perform the fifth trajectory correction
• Weak transition from development to operations
• Communication problems
• Inadequate navigation staffing
• Inadequate training
• Software verification and validation that did not properly cover ground software

The mission was part of NASA's Faster, Better, Cheaper approach. The Phase II investigation found that the Mars Surveyor programme had reduced personnel and funding compared with earlier projects. The programme did not add enough process discipline to control the resulting risks.

The unit mismatch could have been detected at several points. The failure became possible because those checks did not stop the incorrect information from reaching the navigation process.

What NASA learned from the failure?

A reliable system needs to treat units as part of the data rather than relying only on statements in interface documents. The investigation pointed toward several measures. Mission-critical interfaces should be reviewed jointly by systems engineers, software developers and the people who use the data. Acceptance-test results should also be inspected.

Producing and receiving software should be tested together. Ground files should be compared with independent calculations and information already available from the spacecraft. Different navigation solutions should be reconciled when they disagree. Unexplained tracking residuals should be treated as mission risks that require formal investigation. The case showed that software can produce a number that is valid in format but wrong in physical meaning.

Why the Mars Climate Orbiter failure still matters?

The Mars Climate Orbiter is often remembered as a NASA unit conversion mistake. The larger lesson is about software interfaces and communication between teams. Pound-force-seconds and newton-seconds are both legitimate units for measuring impulse. Neither unit caused the failure by itself. The problem came when the same numerical value was interpreted differently on opposite sides of a software interface.

Modern missions depend on many systems, contractors, sensors, software programmes and teams exchanging information. The same risk can appear with units, timestamps, coordinate systems, reference frames, signs, precision and other assumptions.

The Mars Climate Orbiter survived its launch, its journey through space and nine months of operations. Its hardware followed the commands it received. The mission failed because repeated thruster firings changed the spacecraft's real trajectory while the ground navigation model recorded only a fraction of those effects.

The case therefore remains an example of why software validation, interface testing, communication and independent checks are part of spacecraft safety. The main lesson from the Mars Climate Orbiter 1999 failure is not simply that metric and imperial units should never be mixed. It is that a system must verify what a number means before using it to make decisions that cannot be reversed.