Lockheed Martin's ground software produced thruster data in pound-force seconds. NASA JPL expected newton-seconds. The mismatch was not caught in integration testing. The orbiter burned up in the Martian atmosphere.
The $125 million spacecraft was lost. The failure led to significant reforms in NASA's software verification processes and became the most-cited example of interface specification failures in engineering education.
The Incident
On September 23, 1999, NASA's Mars Climate Orbiter — designed to study Martian weather and serve as a communications relay — was lost as it attempted to enter orbit around Mars. Instead of the planned 226-kilometer orbit insertion altitude, the spacecraft approached at approximately 57 kilometers — well inside the atmosphere — and was destroyed.
The Root Cause
The spacecraft's trajectory was controlled by two software systems developed by different organizations. Lockheed Martin's ground-based navigation software produced thruster performance data in pound-force seconds (an imperial unit). NASA's Jet Propulsion Laboratory navigation system expected the data in newton-seconds (a metric unit). One pound-force second equals approximately 4.45 newton-seconds.
The discrepancy accumulated over the 9-month journey to Mars. Each trajectory correction maneuver was slightly wrong. By the time the spacecraft arrived at Mars, the cumulative error put it 170 kilometers lower than intended.
The mismatch was not caught in integration testing because the interface specification was ambiguous about units, and no end-to-end validation of the combined system's output against expected trajectories was performed with sufficient rigor.
Why It Matters
Two correct systems produced a catastrophic result because their shared interface was never validated. The Lockheed software was correct in imperial units. The JPL software was correct in metric units. Both passed their own tests. The failure was not in either system — it was in the space between them.