Anchor: Mars Climate Orbiter — unit-conversion failure across contractor handoff

1. Episode summary

The Mars Climate Orbiter (MCO), a NASA interplanetary spacecraft built by Lockheed Martin Astronautics and operated by NASA's Jet Propulsion Laboratory (JPL), was lost on 23 September 1999 during the Mars orbit-insertion manoeuvre. The proximate technical cause was a unit mismatch in trajectory-correction data: Lockheed Martin's ground software produced thruster-impulse outputs in pound-force-seconds (Imperial units) while the JPL navigation software consumed them as newton-seconds (SI units). The resulting trajectory brought the spacecraft to an atmospheric entry altitude approximately 100 kilometres lower than intended, below the structural survival envelope. The loss originated on two sides of the same contractor handoff: JPL navigators observed trajectory drift during the cruise phase and recorded it but did not diagnose the unit-mismatch origin that the observation was already pointing at, and the Act-phase contractor-handoff process omitted the unit-verification step that standard aerospace practice required. The strategic question the episode turned on was whether the standard observation-to-diagnosis loop and the standard verification-handoff process would together catch the unit mismatch; neither did, and the mission was destroyed at Mars arrival.

2. Sources

Primary:

1. Mars Climate Orbiter Mishap Investigation Board, Phase I Report, NASA, 10 November 1999 — the authoritative primary investigation report.
2. NASA Office of Inspector General, Mars Climate Orbiter Mishap Investigation Board Phase II Report, 2000.
3. NASA and Lockheed Martin contemporaneous programme documentation, press releases, and congressional testimony following the loss event. Includes NASA press release 99-134 (23 September 1999, announcing the loss and attributing it to a navigation error) and JPL press release 99-113.
4. NASA Mars Climate Orbiter Mishap Investigation Board, Phase I Report, §Root Cause and §Contributing Factors (source #1 above) — the MIB Phase I Report identifies the AMD "Small Forces" file produced by Lockheed Martin as the primary software output at the contractor handoff boundary, names the Software Interface Specification (SIS/ICD) between Lockheed Martin's ground software and JPL's navigation system as the interface at which the unit-convention mismatch resided, and documents the absence of end-to-end verification at that boundary as a root-cause contributing factor. The AMD file and SIS/ICD are internal Lockheed Martin engineering documents; primary evidence for the unit mismatch and the handoff failure derives from the MIB Phase I Report's reconstruction and is cited via that report rather than via the underlying proprietary documents directly.

Secondary (with justification):

1. US GAO and congressional post-incident reviews, 1999–2000 — used for procurement-context and accountability-boundary detail beyond the MIB report.
2. Oberg, James, "Why the Mars Probe Went Off Course," IEEE Spectrum, December 1999 — used for accessible technical synthesis of the navigation failure and unit-conversion error; available at http://sunnyday.mit.edu/accidents/mco-oberg.htm
3. Mars Program Independent Assessment Team (MPIAT), Summary Report, March 14, 2000, chaired by Thomas Young — independent review commissioned after the MCO and Mars Polar Lander losses; documents management, oversight, staffing, and training deficiencies attributable to the faster-better-cheaper programme posture; used for Direction, Capability, and Culture evidence. Available at: http://sunnyday.mit.edu/accidents/mpiat_summary.pdf
4. Euler, E.E., Jolly, S.D., and Curtis, H.H., "The Failures of the Mars Climate Orbiter and Mars Polar Lander: A Perspective from the People Involved," Proceedings of Guidance and Control 2001, American Astronautical Society, paper AAS 01-074, 2001 — participant account from JPL and LMA personnel; used for Processes and Capability evidence on end-to-end testing gaps and team familiarity. Available at: https://web.mit.edu/16.070/www/readings/Failures_MCO_MPL.pdf

Tertiary (flagged):

1. Aerospace-engineering textbooks using MCO as a teaching case — used for frame only. Flagged tertiary.

3. OTA narrative

Observe. Observation during the cruise phase was partially performed and partially failed. JPL navigation engineers noticed trajectory drift and recorded it; the drift signal was not missed. What was missed — and was, at the state of 1999 aerospace practice, a reasonable diagnostic step to take — was the follow-through from an unexplained persistent drift to a unit-convention audit across the contractor-handoff ICD. The MIB Phase I record documents multiple trajectory-correction manoeuvres whose residuals persistently pointed at a systematic bias rather than at stochastic noise. Under the reformed reading, Observe is a root-cause phase in this episode: the observation apparatus produced the drift signal it was supposed to produce, but the observation activity did not resolve the signal into the diagnosis that was available. Observe is classified Almost-wrong at the easy end of the task-difficulty axis — the diagnostic follow-through from persistent-bias trajectory residuals to an ICD unit-audit was a standard move for a reasonably-resourced Archetype 5 peer, and it was not made.

Think. Reasoning during the cruise phase was present but not decisive. Navigators considered whether the drift was significant, discussed options including additional trajectory-correction manoeuvres, and reached interpretations that, in retrospect, were not the ones that would have caught the underlying unit issue. Those interpretations were not egregiously wrong given the observation inputs they were working from; a reasonably-resourced peer navigation team reading the same cruise-phase anomalies could have reached similar interpretations without tripping on the units issue. Under the reformed reading, Think is Almost-correct — a slight miss rather than an operative failure. Under P3, because other phases in this case are Wrong (Act) and Almost-wrong (Observe), Think carries weight zero: the operative failure lives in the more-wrong phases and Think's slight miss is not the root cause.

Act. Act is a root-cause phase. By 1999 aerospace standard, inter-contractor unit-verification at the Lockheed-to-JPL software handoff was established routine practice — interface control documents, interface-test verification, and formal ICD sign-off procedures were available technology and were in use at peer agencies. The MIB Phase I report identifies the absence of a formal verification handoff between Lockheed Martin's AMD file-production and JPL's navigation consumption as a root-cause Act-phase process failure. The failure was not in doing something wrong creatively; it was in omitting a routine check that standard practice required. Act is classified Wrong at the easy end of the task-difficulty axis — the execution task was routine for the Archetype 5 peer group, and the routine check was omitted.

---

Note to the Phase 2.3 rater: Sections 4 through 10 of the full anchor file are deliberately withheld from this workspace. You are being asked to score this case on the basis of Sections 1, 2, and 3 only, plus the methodology document and the Peer Reference Sheet. Do not attempt to locate or read the canonical anchor file, any other rater's file, the Phase 2.2 workspace, or any T-022 analysis or decision document. Section 3 (OTA narrative) is scoring-relevant scaffolding in the Phase 2.3 blind contract per the revised §9 of the methodology.

4. Modality evidence

Direction. The programmatic context that shaped every resource, staffing, and verification decision on the Mars Climate Orbiter traces to a single, attributable directional choice: NASA Administrator Daniel Goldin's 1992 adoption of the "faster, better, cheaper" (FBC) doctrine, which directed the agency to reduce mission cost and development time by roughly one order of magnitude relative to predecessor programmes, achieved partly through smaller teams, faster schedules, and greater reliance on contractor-produced deliverables with leaner in-house verification (MPIAT Summary Report, March 2000; MIB Phase II Report). This was a specific, dated, and publicly attributed strategic choice: Goldin introduced FBC at his 1992 appointment and applied it explicitly to the Mars programme, establishing a cadence of robotic Mars missions every two years at a fraction of the Viking-era cost — a commitment that set the MCO budget and staffing ceilings within that envelope (MPIAT Summary Report; NASA congressional testimony). After the MCO and Mars Polar Lander losses, Goldin publicly acknowledged the direction had been pushed too far — "I pushed it too hard" and "that pressure may have made failure inevitable" — confirming both his ownership of the choice and the downstream constraints it imposed (Goldin, "When the Best Must Do Even Better," NASA JPL remarks, 29 March 2000). The Direction evidence meets the Step 1 bar under the Direction Evidence Rule: specific choice (FBC as a programmatic directive applied to Mars missions), datable (1992, operationalised progressively through mid-1990s mission planning), and attributed to an identifiable decision-maker.

The directional choice is relevant to the MCO failure because it set the resource envelope within which the verification and staffing decisions that produced the Act-phase and Observe-phase failures were made. The navigation team's concurrent assignment to three missions simultaneously, the absence of a dedicated end-to-end software verification pass, and the non-performance of an optional final trajectory-correction manoeuvre before Mars arrival were all downstream of a budget and schedule environment shaped by FBC (MPIAT Summary Report; MIB Phase I Report). Direction does not substitute for the Processes failure at the unit-handoff boundary, but it establishes the organisational conditions in which that process gap was tolerated and not escalated.

Structure. The MCO programme was structured as a split between two organisational entities with distinct but overlapping responsibilities: Lockheed Martin Astronautics (LMA) held spacecraft design, build, and launch responsibilities, including production of the AMD (Attitude and Manoeuvre Data) "Small Forces" software file; JPL held overall project management, mission design, navigation, and mission assurance (MIB Phase I Report, §Organisational and Management Information). This two-party arrangement required a formal interface — the Software Interface Specification (SIS) / Interface Control Document (ICD) — to govern the unit conventions, formats, and handoff procedures for data flowing from LMA's ground software to JPL's navigation system. The MIB Phase I Report identifies the verification and validation process "between some project groups, and between the project and its prime mission contractor" as inadequate, naming the structural boundary as the site at which the verification function was absent.

The systems engineering function — the structural role responsible for tracking and double-checking all interconnected aspects of the mission — was not robust enough, exacerbated by the handover from the construction-and-launch team to a new multi-mission operations team (MIB Phase I Report; NASA press release 99-134). This handover transferred custody of the spacecraft without a corresponding transfer of institutional knowledge about the AMD software's unit output. The MIB Phase II Report (March 2000), which examined project management specifically, attributed contributing failures to reporting-line and oversight structures: the project did not have a functioning system that would have surfaced the ICD unit discrepancy to an authority with the mandate and capability to act on it. The structural gap is therefore in the placement of verification authority — it was diffuse across the contractor boundary rather than concentrated in a single integration function with the power to halt delivery until unit conventions were confirmed.

Processes. Processes is the load-bearing modality in this case. The MIB Phase I Report identifies the root cause as a process failure: the "Small Forces" AMD file produced by LMA in pound-force-seconds was consumed by JPL's navigation software as newton-seconds, and no process step in the handoff chain caught the discrepancy (MIB Phase I Report; Oberg, IEEE Spectrum, December 1999). By 1999 aerospace standards, inter-contractor unit verification at a software handoff was established routine practice — interface control documents, formal ICD sign-off, and end-to-end verification procedures were available and in use at peer agencies — making the omission a failure of operational routine rather than a novel execution challenge.

The MIB Phase I Report's eight contributing factors map almost entirely to process failures: (1) absence of end-to-end verification of the AMD software-to-navigation interface; (2) inadequate consideration of the entire mission as a total system; (3) inconsistent communications and training within the project; (4) incomplete understanding by the navigation team of the spacecraft's attitude-control modes relative to earlier missions; (5) non-performance of the final optional trajectory-correction manoeuvre, partly because the process for evaluating its necessity was not completed; and (6) a systems engineering function that was not robust enough to catch cross-boundary errors (MIB Phase I Report). Euler, Jolly and Curtis (AAS 01-074, 2001), writing from direct participant involvement, identify the failure of end-to-end software testing as a separable process gap from the ICD unit discrepancy: the AMD file had never been subjected to an integrated test against the JPL navigation system in a configuration that would have revealed the unit mismatch before flight. The absence of that integration-test process — not merely the incorrect code — is what made the ICD error survivable in development and fatal at Mars.

The Observe-phase near-miss during the cruise phase is also a process failure: the JPL navigation team's anomaly-review process did not include a protocol step for investigating persistent systematic trajectory bias by auditing unit conventions at the contractor ICD (MIB Phase I Report; Oberg 1999). The signal was present in the trajectory residuals; the process for converting that signal into a diagnostic action was absent. These two process gaps — at handoff and at anomaly review — together constitute the proximate failure mechanism.

Capability. The capability picture is more mixed than the processes picture, and the evidence supports a narrower gap than the structural and process evidence. NASA and JPL held deep, documented capability in interplanetary navigation, trajectory modelling, and spacecraft systems engineering as of 1999 — the same teams and organisational lineage had delivered Mars Global Surveyor and Mars Pathfinder successfully in the mid-1990s under FBC (MPIAT Summary Report; MIB Phase II Report). The MPIAT Summary Report (Young, March 2000) does identify specific capability deficiencies: the navigation team was understaffed, concurrently assigned to three separate missions, and insufficiently trained in the characteristics of the MCO spacecraft's attitude-control system relative to the Mars Global Surveyor predecessor, which affected the team's ability to interpret anomalous trajectory data correctly. Euler, Jolly and Curtis (AAS 01-074) corroborate this, noting that the team's familiarity with the AMD file format and its ICD was insufficient to prompt a unit audit when drift signals appeared.

However, the diagnostic capability to perform a unit-convention audit on the ICD was not absent from JPL as an organisation; it was absent from the specific navigation-team workflow applied to this mission, under the staffing and training conditions the FBC envelope permitted. This places the dominant failure closer to Processes (the routines were not in place) and Structure (the verification authority was not concentrated) than to Capability (the skills did not exist). The thin evidence flag applies here: direct documentation of individual skill levels within the 1999 MCO navigation team is limited in the primary sources; the MPIAT report identifies the staffing and training gap but does not provide detailed individual-competence evidence. Raters should weight Capability accordingly.

Scoring note (zero-modality rationale): the capability described in this subsection is recorded at zero per cent in the modality weights on the rationale of insufficient causal weight — the §4 evidence establishes that Mars Climate Orbiter possessed the technical and operational capability the situation required; the failure mechanism was located in Direction, Structure, Processes rather than in a capability gap. The capability is acknowledged as present in the narrative but does not carry standalone weight in the failure attribution. Categorisation under METHODOLOGY-ota-scoring-v4.md §5 "Zero-modality rationale rule": insufficient causal weight.

Culture. Cultural evidence in this case is thinner than process and structure evidence, but it is not absent. The strongest cultural signal comes from the MPIAT Summary Report (Young, March 2000), which documented that agency employees at all levels were reluctant to tell superiors that the challenges facing the Mars missions under FBC were too tough — a pattern Goldin himself acknowledged by saying "that pressure may have made failure inevitable." This describes a culture of upward information suppression, in which navigation engineers who observed anomalous trajectory residuals during the cruise phase did not escalate the anomaly as a potential mission-threatening uncertainty, consistent with a broader norm against surfacing bad news in a programme operating under schedule and cost pressure.

Oberg's IEEE Spectrum account (December 1999) and the MIB Phase I Report both note that the trajectory anomalies were discussed within the navigation team but were not treated as potential indicators of a systematic, cross-boundary error. The failure to escalate from "anomaly noted" to "unit-convention audit requested" could reflect either a process gap (no escalation protocol) or a cultural norm (no expectation that such escalation would be welcome). The MIB record supports both interpretations; the primary evidence does not cleanly separate them. The Processes / Culture boundary test from the methodology applies: the formal escalation machinery existed (trajectory anomalies were reviewed in regular navigation team meetings), suggesting that the failure to pursue the diagnosis further sits closer to the informal layer — the shared assumption that persistent small residuals were a manageable feature of the mission rather than a diagnostic red flag. This cultural default of normalised anomaly tolerance, under FBC pressure, is the Culture modality contribution. Evidence here is secondary and inferential, and raters should note its moderate confidence.

Scoring note (zero-modality rationale): the cultural evidence in this subsection is acknowledged in the narrative but is not load-bearing for the strategic failure causation of the episode — the §4 evidence itself characterises it as thinner than process and structure evidence compared with the modalities that carried the failure causation (Direction, Structure, Processes). Culture is therefore recorded at zero per cent on the rationale of modality acknowledged in narrative but not load-bearing for the strategic value created in the episode. Categorisation under METHODOLOGY-ota-scoring-v4.md §5: modality acknowledged in narrative but not load-bearing.

---