Mars Climate Orbiter: When 1 N·s Was Read as 1 lbf·s

Nothing broke. That is the part worth sitting with. There was no failed bearing, no cracked tank, no software crash, no leak, no dead sensor. Every component of the mission did precisely what it was built to do, and both systems either side of the failed interface produced numbers that were internally consistent: real pound-force-seconds on one side, a correct reading of newton-seconds on the other. What neither satisfied was the contract joining them. The loss happened in the space between two teams who each believed they were speaking the same language, and the word they disagreed about was not a word at all — it was the unit attached to it.

This is the accident that made "unit error" a phrase spacecraft engineers say out loud, and it is a strict sibling to the Gimli Glider sixteen years earlier: the same failure shape, a right number carrying a wrong unit, in a machine with no way to complain. But the Gimli Glider at least had a human holding a pencil who could have caught it. The Mars Climate Orbiter had a file. The file contained no unit field. And the error it carried was not 2.2× but 4.4482216152605×, applied not once but hundreds of times, in a direction that no instrument on Earth could observe.

The Conversion That Was Never Performed

Start with the number, because the number is where most retellings of this story go soft. The Mars Climate Orbiter Mishap Investigation Board, in its Phase I report of 10 November 1999, described the effect as "a factor of 4.45." That figure has been quoted ever since, and it is close enough for a headline — but it is not the value any engineer would type into a calculator, and the gap between the two is itself instructive.

Pound-force is defined by two other definitions stacked together: the international avoirdupois pound of the 1959 Yard and Pound Agreement, fixed at exactly 0.45359237 kilograms, multiplied by standard gravity, fixed at exactly 9.80665 m/s². Multiply those and you get the exact conversion:

0.45359237 kg × 9.80665 m/s² = 4.4482216152605 N   (exact, by definition)

The seconds cancel. This is the technical point that almost every popular account of the Mars Climate Orbiter skips, and it matters because it is the reason the error is so easy to mislabel. The unit that was written wrongly was not "pounds" — it was pound-force-seconds, a unit of impulse, not of force. A second of pound-force and a second of newton-force both last one second; the second is identical on both sides. What differed was the force being multiplied by it. So the conversion factor for the impulse is exactly the conversion factor for the force, and it is 4.4482216152605:

1 lbf·s = 4.4482216152605 N·s     1 N·s = 0.2248089431 lbf·s

Which makes the board's "4.45" a rounding to three significant figures — a value 0.040% above the exact factor. That rounding has cost the accident a certain amount of clarity over the years, because it invites the wrong lesson. Nobody chose 4.45 over 4.4482216152605. Nobody chose anything. The factor was never applied at all. The error is not a precision problem that better rounding would have fixed; it is a missing multiplication, the most complete kind of error there is, sitting at a boundary where no one was checking.

What the file actually said

The Mars Climate Orbiter Mishap Investigation Board was unambiguous about where the failure lived. Root cause: "the failure to use metric units in the coding of a ground software file, 'Small Forces,' used in trajectory models." The program was called SM_FORCES. Its output was written into another file, the AMD file — angular momentum desaturation — which the JPL navigation team then read as input to its trajectory model. The Software Interface Specification (SIS) governing that file defined both its format and its units, and it called for newton-seconds.

SM_FORCES wrote pound-force-seconds. The SIS was not followed. And here is the detail that turns a coding mistake into a systems failure: the file carried no unit field. It was a column of numbers with a header describing their arrangement, not their meaning. The navigation software had no way to test what it was reading, and no reason to doubt it. It applied those numbers as newton-seconds and updated the spacecraft's predicted position — hundreds of times — understating the impulse of each firing by a factor of 4.4482216152605.

Impulse Is Not Force: Why a Thruster Is Rated in N·s

To see why this particular quantity was so fragile, you have to understand what the spacecraft was doing out there, and it was not firing its engine. The orbiter carried reaction wheels — heavy discs spun by electric motors to point the spacecraft without burning propellant. Push a wheel one way and the body turns the other, which is how a satellite changes attitude without wasting fuel. But a wheel can only spin so fast, and once it saturates it stops providing torque. The stored momentum has to be dumped, and the only way to dump it in vacuum is to fire small thrusters and let them carry the momentum away. Engineers call this angular momentum desaturation, or AMD.

An AMD event is not a steady burn. It is a burst of short pulses from small attitude thrusters, some of them firing in tens of milliseconds. For each pulse the flight team's trajectory model needs a number called the impulse bit — the momentum one minimum-length firing delivers, supplied by the thruster manufacturer. With that and the firing count you can compute the velocity change the spacecraft actually received:

Δv = (impulse bit × number of pulses) ÷ spacecraft mass

Run that in newtons and you get metres per second. Run it with a pound-force-second silently substituted for a newton-second and your Δv comes out 4.4482216152605 times too small — not wrong in arithmetic, wrong in meaning. The NASA board phrased it precisely: "Immediately after the thruster firing, the velocity change (Δv) is computed using an impulse bit and thruster firing time for each of the thrusters." The impulse bit is where the unit lived. It is a single scalar in a table, and it was the only place in the chain where the error needed to hide.

What made this lethal rather than merely embarrassing was the rate. Pre-flight analysis predicted AMD events would be needed about once a week during cruise. The solar array was mounted asymmetrically relative to the spacecraft body, shifting the centre of pressure away from the centre of mass, and sunlight pushing on that offset produced steady torque that filled the wheels far faster than planned. The actual rate was 10 to 20 events per week — an order of magnitude more than designed for. A daily 180° spacecraft rotation had originally been scheduled, which would have swung the solar pressure torque back and forth and largely cancelled the momentum buildup; those daily turns were deleted from the operations plan before launch. So the one mechanism that would have suppressed the AMD rate was removed, and the effect that was being modelled with the wrong unit was multiplied by ten.

The Error Nothing Could See

Here is the part of the investigation that deserves more attention than it gets. The navigation team was not flying blind. JPL tracked the orbiter continuously using the Deep Space Network, measuring the Doppler shift of the radio carrier and the round-trip light time to determine where the spacecraft was and how fast it was moving. They had good data. They simply could not see this particular effect in it.

Two geometric facts conspired. First, thrust during an AMD event pointed mostly perpendicular to the line of sight between Earth and spacecraft. Doppler tracking is exquisitely sensitive to motion along the line of sight and nearly blind to motion across it — so the component of thrust that was mis-modelled was the component the tracking could least resolve. Second, the thrust was also mostly perpendicular to the spacecraft's flight path. A sideways push on a trajectory does not change speed much; it changes the shape and the altitude of the resulting orbit. The error therefore did not show up as a velocity anomaly. It showed up, much later, as the spacecraft arriving at the wrong height.

The navigators did notice something was off. Approaching Mars they ran orbit determination three ways — Doppler data only, range data only, and both together — and compared the answers for consistency. The three did not agree. The Doppler-only solutions consistently indicated a closer approach to the planet; the range-only solutions indicated a more distant one. That disagreement is the signature of a systematic error rather than random noise, and it was recorded. But the AMD data, once it was usable at all, had been assigned relatively large error bars in the orbit determination because its quality was already known to be poor. The uncertainty was acknowledged and then absorbed. The real error was larger than the error bar that was supposed to contain it.

Four Months of Warning That Arrived Too Late

The AMD files were not even usable for the first four months of cruise. Multiple file-format errors and incorrect quaternion specifications — quaternions carry the spacecraft's attitude data — meant the navigation team could not process them at all. Instead they received emails from the contractor telling them when an AMD event had occurred, and tried to model the trajectory perturbation themselves from timing alone. Four months went into fixing the files. It was not until April 1999 that the correctly formatted AMD files could be used.

Within about a week of finally running them, it became apparent that the files contained anomalous data suggesting the desaturation events were being underestimated. The root cause was now one focused investigation away — and it was not found. The board noted that the early file-format problems had themselves contributed to the mission's loss, by burning the time the team would have needed to chase the anomaly down properly.

At least two navigators raised concerns about the discrepancy between calculated and measured position. Their concerns were dismissed because they had not filled out the correct form to document them. NASA's own report is that dry about it. The organisation had a procedure for raising a technical concern, the concern did not travel through the procedure, and so the concern did not travel at all.

A meeting was then convened — trajectory software engineers, navigators, propulsion engineers, managers — to consider executing Trajectory Correction Maneuver 5, a contingency burn that was already in the plan and could have raised the arrival altitude. Attendees remember agreeing to do it. TCM-5 was never performed. The reasons given were schedule risk, the effect on the Mars Polar Lander relay sequence, and the fact that the procedures for the maneuver had never been developed in advance. The board later concluded that executing it might have saved the spacecraft.

Edward Weiler, NASA's associate administrator for space science, put the finding where it belonged: "People sometimes make errors. The problem here was not the error, it was the failure of NASA's systems engineering, and the checks and balances in our processes to detect the error. That's why we lost the spacecraft." The board's chief investigator, Arthur Stephenson, was more specific: "Had we done end-to-end testing, we believe this error would have been caught."

226, 170, 110, 57

Four numbers tell the whole descent, and they arrived in sequence over the last two weeks of the mission's life.

226 km was the target. Trajectory Correction Maneuver 4 was computed on 8 September 1999 and executed on 15 September, aimed at putting the orbiter at that altitude for the orbit insertion burn on the 23rd. 226 km is 140 miles — close enough to Mars for the burn to capture the spacecraft, high enough to stay clear of the atmosphere it was supposed to skim through for weeks of aerobraking.

150 to 170 km is where the prediction went during the week after TCM-4. The navigation team saw the modelled arrival altitude dropping and flagged it. The response was not to suspect a systematic error in the thrust model, because the thrust model's numbers were all internally consistent, and the AMD data had already been assigned wide error bars. The response was that a trajectory correction might be needed.

110 km is where the solution stood twenty-four hours before arrival, once Mars's gravity began dominating the dynamics and the orbit fits sharpened. That was thirty kilometres above the 80 km the spacecraft was believed able to survive during the passage. It was uncomfortably tight and, according to the engineers' own models, still survivable.

57 km is where it actually was. That number could only be computed after the fact, using the last telemetry received plus corrected AMD data, and it is the honest measure of how wrong the trajectory model had been. At 57 km, atmospheric density would have been far higher than the orbiter was designed to withstand. The board's reconstruction concluded the spacecraft either broke up from aerodynamic stress, or skipped violently off the upper atmosphere and was thrown back into a solar orbit — lost either way. The signal was lost at 09:04:52 UTC on 23 September 1999, when Mars rose between the spacecraft and Earth. It never came back. NASA searched for forty-eight hours and declared the orbiter lost on 25 September.

What the Loss Actually Cost — and Why the Figure Keeps Changing

The number most often attached to this accident is $327.6 million, and it is accurate, but it is answering a different question than people think. That figure covers the whole Mars Surveyor '98 programme, which funded two spacecraft: the Climate Orbiter and the Mars Polar Lander. NASA's breakdown is $193.1 million for spacecraft development, $91.7 million for launch, and $42.8 million for mission operations. If you want the orbiter alone, the figure usually cited is around $125 million.

The distinction matters more than a footnote usually would, because the Mars Polar Lander was also lost — on 3 December 1999, ten weeks later — and it is routinely folded into the same story. It should not be. The Polar Lander failed for an unrelated reason: spurious signals from its landing-leg sensors during descent were interpreted as touchdown, shutting the engines off while the spacecraft was still high above the surface. No unit error was involved. Two missions, two failures, two entirely separate causes — but one shared programme budget, one shared "faster, better, cheaper" management philosophy, and one shared inquiry culture that people have been merging into a single narrative ever since. Ranking these mistakes by cost requires knowing which pot of money you are dividing.

What the Orbiter Teaches Engineers

The Mars Climate Orbiter is the standard example in every talk about unit discipline, usually reduced to "label your units." That advice is correct and also too small, because everyone involved in this mission did label their units — in the specification, in the requirements documents, in the review packages. The labels existed. The failure was that the labels were not in the data.

The first lesson is therefore about interfaces rather than arithmetic. A file format that transmits numbers without transmitting their units is an incomplete contract, and a contract with a missing term cannot be tested. Neither SM_FORCES nor the navigation software did anything wrong in isolation. Each was correct by its own internal standard, and the interface between them had no way to express disagreement. When two correct systems can be wrong together, the defect is in the boundary, and it belongs to whoever owns the boundary — which in practice means the systems engineer, not the coder. The board's Phase I report lists eight contributing causes, and the first is not "someone used the wrong unit." It is that no verification step was checking the physical units of the data being consumed, only its numeric plausibility.

The second lesson is about where unit errors are invisible, and this is the one worth carrying into your own work. The 4.4482216152605 factor was applied in a direction that the measuring instruments could not see: perpendicular to the line of sight, perpendicular to the flight path. If the same error had occurred in the main engine burn, Doppler tracking would have screamed on the first maneuver, because that thrust is aimed along the direction being measured. The general rule that falls out of this accident is uncomfortable. A unit error is most likely to survive when it hides in the component of the physics you are least capable of observing — the cross-track component, the off-axis term, the small correction you apply for housekeeping, the loss factor nobody measures directly. If you are going to be sloppy with units anywhere, that is where it will go undetected. Do the opposite: that is exactly where the unit needs to be checked hardest.

The third lesson is that disagreement between independent measurements is evidence, not noise. The Doppler-only orbit solution and the range-only orbit solution disagreed about how close the spacecraft would pass to Mars, and both were plotted and compared — that comparison was built into the process. What was missing was the next step: asking why two independent methods would differ in a consistent direction. A consistent disagreement in a consistent direction is the fingerprint of a systematic error, and a systematic error that is not in your measurement equipment is in your model. The team treated the spread as uncertainty to be carried forward. It was information to be chased down.

And the fourth lesson is that the window for catching this was open for months and closed only gradually. Four months were lost to unusable files. In April 1999 the anomaly was visible within a week of the data becoming readable. Two navigators raised concerns and were blocked by a form. A meeting agreed on a corrective burn and no burn occurred. Every one of these was a survivable failure on its own; lined up in sequence, they guaranteed the outcome. The board counted eight contributing causes for a reason — the shape of this accident is not a single missing multiplication but a series of organisations declining, one after another, to act on information they already had.

Related Converters

The whole accident turns on one conversion between two units of impulse. These are the tools for working it out precisely:

• Newtons to lbs — 4.4482216152605 N is exactly 1 lbf; the factor the ground software omitted
• lbs to Newtons — the reverse direction: 1 lbf = 4.4482216152605 N; apply it for one second and you have the newton-second
• Newtons to kgf — standard gravity 9.80665 m/s², the second half of the pound-force definition
• kgf to lbf — the two "gravitational" force units, and why both depend on the same constant
• Force — newtons, pound-force, kilogram-force and dynes in one place
• kg to lbs — 0.45359237 exactly, the definition this entire failure traces back to
• km to miles — the 226 km target (140 mi) and the 57 km the orbiter actually reached (35 mi)
• MHz to GHz — the X-band downlink the Deep Space Network used to watch a spacecraft it could not see go sideways

Related Guides

• Force Conversion Guide — the anchor constants behind newtons, pound-force and kilogram-force, including the 4.4482216153 value at the centre of this accident.
• Gimli Glider: The 22,300 kg That Arrived as 22,300 lb — the same failure shape sixteen years earlier, and the reason a right number with a wrong unit is more dangerous than a wrong number.
• The 8 Most Expensive Unit Conversion Mistakes in Engineering History — the Mars Climate Orbiter alongside the Patriot Missile, the Vasa, Deepwater Horizon and four more.
• Korean Air Cargo 6316: When 1,500 Meters Became 1,500 Feet — the same class of altitude confusion, in an aircraft on approach rather than a spacecraft on arrival.
• Concorde 4590: The 43 cm of Titanium That Grounded Mach 2 — how a centimetre-scale measurement error removed an aircraft from service.

Frequently Asked Questions

What caused the loss of the Mars Climate Orbiter?

A ground software program called SM_FORCES, written by Lockheed Martin, wrote thruster-impulse values in pound-force-seconds (lbf·s) into the AMD file. The project's Software Interface Specification required newton-seconds (N·s), and the JPL navigation software read them as N·s. The modelled impulse of every angular momentum desaturation firing was therefore underestimated by a factor of 4.4482216152605, and the accumulated trajectory error brought the spacecraft to 57 km instead of the targeted 226 km, below the 80 km it could survive.

Is 1 lbf·s exactly 4.4482216152605 N·s?

Yes, and it is exact by definition rather than measurement. Pound-force is the weight of one international avoirdupois pound under standard gravity, so it equals 0.45359237 kg × 9.80665 m/s² = 4.4482216152605 newtons. Because the "per second" is identical on both sides, the same factor converts pound-force-seconds to newton-seconds. Going the other way, 1 N·s = 0.2248089431 lbf·s.

Why do reports say the error was a factor of 4.45 and not 4.4482216152605?

The Mishap Investigation Board's Phase I report rounded the conversion to three significant figures, writing "a factor of 4.45." The exact value is 4.4482216152605, so the reported figure is about 0.040% high. The rounding does not affect the conclusion — the real problem was not precision but the complete absence of the multiplication.

Why didn't the navigation team notice the trajectory was wrong?

The mis-modelled thrust pointed mostly perpendicular to the Earth-spacecraft line of sight, so Doppler tracking — which measures motion along that line — could barely see it. It was also perpendicular to the flight path, so it changed the arrival altitude rather than the speed. The team did detect an inconsistency between Doppler-only and range-only orbit solutions, but the AMD data already carried wide error bars, and the discrepancy was absorbed as uncertainty instead of being investigated as a systematic error.

How much did the Mars Climate Orbiter cost?

NASA's $327.6 million figure covers the entire Mars Surveyor '98 programme, which included both the Climate Orbiter and the Mars Polar Lander: $193.1 million for spacecraft development, $91.7 million for launch, and $42.8 million for mission operations. The orbiter alone is usually cited at about $125 million. The Polar Lander was lost ten weeks later for a completely unrelated reason, so the two failures share a budget but not a cause.

Could the mission have been saved?

The Mishap Investigation Board concluded that executing Trajectory Correction Maneuver 5 before arrival might have raised the periapsis altitude enough to save the spacecraft. A meeting of engineers and managers agreed to perform it, and it was never carried out — procedural planning for the maneuver had not been done in advance, and there were concerns about risk and about disrupting the Mars Polar Lander relay sequence.

Sources

Primary sources

• NASA, Mars Climate Orbiter Mishap Investigation Board Phase I Report (10 November 1999) — root cause, the SM_FORCES/AMD file finding, the eight contributing causes, and the geometry that kept the error invisible
• NASA Jet Propulsion Laboratory, The Evolution of Deep Space Navigation: 1989–1999 (AAS 08-311) — AMD event rates, TCM-4 and the TCM-5 contingency, and the post-loss reconstruction of the 57 km periapsis
• NASA Jet Propulsion Laboratory, Mars Climate Orbiter Team Finds Likely Cause of Loss (1999) — the agency's contemporaneous statement of cause

Secondary references

• IEEE Spectrum, "Why the Mars Probe Went Off Course" (1999) — interviews with the mission team and NASA management
• 1959 International Yard and Pound Agreement (1 lb = 0.45359237 kg) and the CGPM standard gravity of 9.80665 m/s², the two definitions behind the exact 4.4482216152605 factor