Mars Climate Orbiter burned up because ground software mixed English and metric units

Mars Climate Orbiter launched on December 11, 1998, and was lost sometime after entering Mars occultation during orbit insertion on September 23, 1999. NASA's Mishap Investigation Board traced the root cause to a ground software file, SM_FORCES, that delivered thruster performance data in English units to trajectory models that assumed metric data, as the interface documentation required.

Because the spacecraft's asymmetric solar array caused angular momentum desaturation events 10 to 14 times more often than expected, the small unit error accumulated over the nine-month cruise. At Mars insertion the trajectory was about 170 kilometers lower than planned, so the spacecraft either burned up in the atmosphere or skipped back into heliocentric space.

The board stressed that mistakes happen on projects; what failed was the system of checks. Contributing causes included undetected mismodeling of velocity changes, an unfamiliar navigation team, inadequate staffing and training, weak verification of ground software, and poor communication between JPL and Lockheed Martin. The board's recommendations were applied to the Mars Polar Lander, which was lost two months later for separate reasons.

Spacecraft lost on arrival September 23, 1999; NASA's fact sheet put the orbiter-plus-lander project at $327.6M, with $193.1M for spacecraft development.

SM_FORCES output thruster data in English units while the interface required metric.

Trajectory modelers assumed the data was metric, so the error was invisible for nine months.

Frequent desaturation maneuvers multiplied the small per-maneuver error.

No verification step compared navigation estimates against an independent method.

Inadequate staffing and training left the navigation team unable to notice the drift.

Specify units in every interface contract and machine-check. A pound-versus-newton error ran nine months because nothing checked navigation output independently — the checks failed, not the people.

NASA mandated unit verification across mission software, software audits on all data transferred between JPL and Lockheed Martin, independent navigation checks, and better training and staffing. The mishap became the canonical example of unit-mismatch failure in engineering education and a cautionary tale for any organization with contractor handoffs.