Mars Climate Orbiter: a units mismatch across team boundaries
The interface specification required newton-seconds. Ground software sent pound-force seconds.
- Programme
- Mars Climate Orbiter
- Year
- 1999
- Sector
- Space
- Outcome
- Spacecraft lost at Mars arrival
What happened
Mars Climate Orbiter was lost on arrival at Mars.
Ground software sent thruster data in pound-force seconds, while the interface specification required newton-seconds.
What was found
The NASA Mishap Investigation Board's Phase I Report identified the discrepancy between the units in the ground software output and the units required by the interface specification.
The discrepancy crossed team and organisational boundaries without being detected.
Engineering lesson
An interface specification is only protective if both sides are verified against it. A correct specification does not prevent an implementation that departs from it.
Interfaces that cross team or organisational boundaries are where ownership of verification is easiest to lose, because each side can reasonably assume the other has checked.
The practice this points to
Give every cross-boundary interface a clear owner and verify each side's implementation against the agreed specification, including units.
Make interface verification evidence visible to both parties, so neither assumes the other has done the check.
Where Kelvora fits
Kelvora is a requirements and assurance platform that records interface requirements once and traces each side's verification to them. It can help teams see where an interface crossing a boundary has no verification evidence from one side.
Sources
- NASA, Mars Climate Orbiter Mishap Investigation Board Phase I Report, November 1999.