MarsClimateOrbiter

MishapInvestigationBoard
PhaseIReport
November10,1999

TableofContents
MarsClimateOrbiterMishapInvestigationBoardPhaseI
Report

SignaturePage(BoardMembers)
ListofConsultants
Acknowledgements
ExecutiveSummary
1.

MarsClimateOrbiter(MCO)andMarsPolarLander(MPL)
ProjectDescriptions

5.

2.

MCOMishap

3.

MethodofInvestigation

4.

MCORootCausesandMPLRecommendations

MCOContributingCausesandObservationsand
MPLRecommendations

6.

MCOObservationsandMPLRecommendations

7.

MPLObservationsandRecommendations

8.

PhaseIIPlan

Appendix:LetterEstablishingtheMCOMishapInvestigationBoard
Acronyms

SignaturePage
__________/s/________________
ArthurG.Stephenson
Chairman
GeorgeC.MarshallSpaceFlightCenter
Director
__________/s/_______________
Dr.DanielR.Mulville
ChiefEngineer
NASAHeadquarters

__________/s/_______________
FrankH.Bauer
Chief,Guidance,NavigationandControl
Center
GoddardSpaceFlightCenter
__________/s/_______________
GregA.Dukeman
GuidanceandNavigationSpecialist
VehicleFlightMechanicsGroup
GeorgeC.MarshallSpaceFlightCenter

__________/s/_______________
Dr.PeterNorvig
Chief,ComputationalSciencesDivision
AmesResearchCenter

__________/s/_______________
Approved
Dr.EdwardJ.Weiler
AssociateAdministrator
OfficeofSpaceScience
Advisors:
OfficeofChiefCounsel:MSFC/LouisDurnya
OfficeofPublicAffairs:HQs/DouglasM.Isbell

Consultants
AnnMerwarth

NASA/GSFCretired
Expertingroundoperations&flightsoftware
development

MosheF.Rubinstein

Prof.Emeritus,
UniversityofCalifornia,LosAngeles
Civilandenvironmentalengineering

JohnMari

VicePresidentofProductAssurance
LockheedMartinAstronautics

PeterSharer

SeniorProfessionalStaff
MissionConceptsandAnalysisGroup
TheJohnsHopkinsUniversity
AppliedPhysicsLaboratory

CraigStaresinich

ChandraXrayObservatoryProgramManager
TRW

Dr.MichaelG.Hauser

DeputyDirector
SpaceTelescopeScienceInstitute

TimCrumbley

DeputyGroupLead
FlightSoftwareGroup
AvionicsDepartment
GeorgeC.MarshallSpaceFlightCenter

DonPearson

AssistantforAdvancedMissionDesign
FlightDesignandDynamicsDivision
MissionOperationsDirectorate
JohnsonSpaceCenter

Acknowledgements

TheMarsClimateOrbiterMishapInvestigationBoardwishestothankthetechnical
teamsfromJetPropulsionLaboratory(JPL)andLockheedMartinAstronauticsfor
theircooperationwhichwasessentialinourreviewoftheMarsClimateOrbiterand
MarsPolarLanderprojects.SpecialthankstoLiaLaPianaandFrankBauerforpulling
thisreporttogetherwiththesupportoftheentireBoardandconsultants.

ExecutiveSummary
ThisPhaseIreportaddressesparagraph4.A.oftheletterestablishingtheMarsClimate
Orbiter(MCO)MishapInvestigationBoard(MIB)(Appendix).Specifically,paragraph
4.A.oftheletterrequeststhattheMIBfocusonanyaspectsoftheMCOmishapwhich
mustbeaddressedinordertocontributetotheMarsPolarLanderssafelandingon
Mars.TheMarsPolarLander(MPL)entrydescentlandingsequenceisscheduledfor
December3,1999.
ThisreportprovidesatopleveldescriptionoftheMCOandMPLprojects(section1),it
definestheMCOmishap(section2)andthemethodofinvestigation(section3)andthen
providestheBoardsdeterminationoftheMCOmishaprootcause(section4),theMCO
contributingcauses(section5)andMCOobservations(section6).BasedontheMCO
rootcause,contributingcausesandobservations,theBoardhasformulatedaseriesof
recommendationstoimprovetheMPLoperations.Theseareincludedintherespective
sections.Also,asaresultoftheBoardsreviewoftheMPL,specificobservationsand
associatedrecommendationspertainingtoMPLaredescribedinsection7.Theplanfor
thePhaseIIreportisdescribedinsection8.ThePhaseIIreportwillfocusonthe
processesusedbytheMCOmission,developlessonslearned,andmake
recommendationsforfuturemissions.
TheMCOMissionobjectivewastoorbitMarsasthefirstinterplanetaryweathersatellite
andprovideacommunicationsrelayfortheMPLwhichisduetoreachMarsin
December1999.TheMCOwaslaunchedonDecember11,1998,andwaslostsometime
followingthespacecraft'sentryintoMarsoccultationduringtheMarsOrbitInsertion
(MOI)maneuver.Thespacecraft'scarriersignalwaslastseenatapproximately09:04:52
UTConThursday,September23,1999.
TheMCOMIBhasdeterminedthattherootcauseforthelossoftheMCOspacecraftwas
thefailuretousemetricunitsinthecodingofagroundsoftwarefile,SmallForces,
usedintrajectorymodels.Specifically,thrusterperformancedatainEnglishunitsinstead
ofmetricunitswasusedinthesoftwareapplicationcodetitledSM_FORCES(small
forces).AfilecalledAngularMomentumDesaturation(AMD)containedtheoutputdata
fromtheSM_FORCESsoftware.ThedataintheAMDfilewasrequiredtobeinmetric
unitsperexistingsoftwareinterfacedocumentation,andthetrajectorymodelersassumed
thedatawasprovidedinmetricunitspertherequirements.
Duringthe9monthjourneyfromEarthtoMars,propulsionmaneuverswereperiodically
performedtoremoveangularmomentumbuildupintheonboardreactionwheels
(flywheels).TheseAngularMomentumDesaturation(AMD)eventsoccurred1014
timesmoreoftenthanwasexpectedbytheoperationsnavigationteam.Thiswasbecause
theMCOsolararraywasasymmetricalrelativetothespacecraftbodyascomparedto
MarsGlobalSurveyor(MGS)whichhadsymmetricalsolararrays.Thisasymmetric
effectsignificantlyincreasedtheSuninduced(solarpressureinduced)momentum
builduponthespacecraft.TheincreasedAMDeventscoupledwiththefactthatthe
angularmomentum(impulse)datawasinEnglish,ratherthanmetric,units,resultedin
6

smallerrorsbeingintroducedinthetrajectoryestimateoverthecourseofthe9month
journey.AtthetimeofMarsinsertion,thespacecrafttrajectorywasapproximately170
kilometerslowerthanplanned.Asaresult,MCOeitherwasdestroyedintheatmosphere
orreenteredheliocentricspaceafterleavingMarsatmosphere.
TheBoardrecognizesthatmistakesoccuronspacecraftprojects.However,sufficient
processesareusuallyinplaceonprojectstocatchthesemistakesbeforetheybecome
criticaltomissionsuccess.UnfortunatelyforMCO,therootcausewasnotcaughtbythe
processesinplaceintheMCOproject.
Asummaryofthefindings,contributingcausesandMPLrecommendationsarelisted
below.ThesearedescribedinmoredetailinthebodyofthisreportalongwiththeMCO
andMPLobservationsandrecommendations.
RootCause: Failuretousemetricunitsinthecodingofagroundsoftwarefile,
SmallForces,usedintrajectorymodels
ContributingCauses:1.Undetectedmismodelingofspacecraftvelocitychanges
2. NavigationTeamunfamiliarwithspacecraft
3. Trajectorycorrectionmaneuvernumber5notperformed
4. Systemengineeringprocessdidnotadequately
addresstransitionfromdevelopmenttooperations
5. Inadequatecommunicationsbetweenprojectelements
6. InadequateoperationsNavigationTeamstaffing
7. Inadequatetraining
8. Verificationandvalidationprocessdidnotadequatelyaddress
groundsoftware
MPLRecommendations:
VerifytheconsistentuseofunitsthroughouttheMPLspacecraft
designandoperations
Conductsoftwareauditforspecificationcomplianceonalldata
transferredbetweenJPLandLockheedMartinAstronautics
VerifySmallForcesmodelsusedforMPL
CompareprimeMPLnavigationprojectionswithprojections
byalternatenavigationmethods
TrainNavigationTeaminspacecraftdesignandoperations
Prepareforpossibilityofexecutingtrajectorycorrection
maneuvernumber5
EstablishMPLsystemsorganizationtoconcentrateon
trajectorycorrectionmaneuvernumber5andentry,descentand
landingoperations
Takestepstoimprovecommunications

MPLRecommendations(Continued):
AugmentOperationsTeamstaffwithexperiencedpeopleto
supportentry,descentandlanding
TrainentireMPLTeamandencourageuseofIncident,
Surprise,Anomalyprocess
Developandexecutesystemsverificationmatrixfor
allrequirements
Conductindependentreviewsonallmissioncriticalevents
ConstructafaulttreeanalysisforremainderofMPLmission
AssignoverallMissionManager
Performthermalanalysisofthrustersfeedlineheatersand
consideruseofpreconditioningpulses
Reexaminepropulsionsubsystemoperationsduring
entry,descent,andlanding

1. MarsClimateOrbiter(MCO)andMars
PolarLander(MPL)ProjectDescriptions
In1993,NASAstartedtheMarsSurveyorprogramwiththeobjectiveofconductingan
ongoingseriesofmissionstoexploreMars.TheJetPropulsionLaboratory(JPL)was
identifiedastheleadcenterforthisprogram.MarsGlobalSurveyor(MGS)was
identifiedasthefirstflightmission,withalaunchdateinlate1996.In1995,two
additionalmissionswereidentifiedforlaunchinlate1998/early1999.Themissionswere
theMarsClimateOrbiter(MCO)andtheMarsPolarLander(MPL).JPLcreatedthe
MarsSurveyorProject98(MSP98)officewiththeresponsibilitytodefinethe
missions,developbothspacecraftandallpayloadelements,andintegrate/test/launchboth
flightsystems.Inaddition,theProgramspecifiedthattheMarsSurveyorOperations
Project(MSOP)wouldberesponsibleforconductingflightoperationsforbothMCOand
MPLaswellastheMGS.
TheMSP98DevelopmentProjectusedaprimecontractvehicletosupportproject
implementation.LockheedMartinAstronautics(LMA)ofDenver,Coloradowasselected
astheprimecontractor.LMAscontracteddevelopmentresponsibilitiesweretodesign
anddevelopbothspacecraft,leadflightsystemintegrationandtest,andsupportlaunch
operations.JPLretainedresponsibilitiesforoverallprojectmanagement,spacecraftand
instrumentdevelopmentmanagement,projectsystemengineering,missiondesign,
navigationdesign,missionoperationsystemdevelopment,grounddatasystem
development,andmissionassurance.TheMSP98projectassignedtheresponsibilityfor
missionoperationssystems/grounddatasystems(MOS/GDS)developmenttotheMSOP,
LMAprovidedsupporttoMSOPforMOS/GDSdevelopmenttasksrelatedtospacecraft
testandoperations.
TheMCOwaslaunchedDecember11,1998,andtheMPLwaslaunchedJanuary3,
1999.BothwerelaunchedatopidenticalDeltaIIlaunchvehiclesfromLaunchComplex
17AandBatCapeCanaveralAirStation,Florida,carryinginstrumentstomapthe
planetssurface,profilethestructureoftheatmosphere,detectsurfaceicereservoirsand
digfortracesofwaterbeneathMarsrustysurface.
Thelanderalsocarriesapairofbasketballsizedmicroprobes.Thesemicroprobeswillbe
releasedasthelanderapproachesMarsandwilldivetowardtheplanetssurface,
penetratinguptoabout1meterundergroundtotest10newtechnologies,includinga
scienceinstrumenttosearchfortracesofwaterice.Themicroprobeproject,calledDeep
Space2,ispartofNASAsNewMillenniumProgram.
ThesemissionswerethesecondinstallmentinNASAslongtermprogramofrobotic
explorationofMars,whichwasinitiatedwiththe1996launchesofthecurrently
orbitingMarsGlobalSurveyorandtheMarsPathfinderlanderandrover.
TheMSOPassumedresponsibilityforbothMCOandMPLatlaunch.MSOPis
implementedinapartneringmodeinwhichdistinctoperationsfunctionsareperformed

byageographicallydistributedsetofpartners.LMAperformsallspacecraftoperations
functionsincludinghealthandstatusmonitoringandspacecraftsequencedevelopment.
Inaddition,LMAperformsrealtimecommandandmonitoringoperationsfromtheir
facilityinDenver,Colorado.JPLisresponsibleforoverallprojectandmission
management,systemengineering,qualityassurance,GDSmaintenance,navigation,
missionplanning,andsequenceintegration.Eachofthescienceteamsisresponsiblefor
planningandsequencingtheirinstrumentobservations,processingandarchivingthe
resultingdata,andperformingofflinedataanalysis.Theseoperationsaretypically
performedatthePrincipalInvestigatorshomeinstitution.MSOPpersonnelarealso
currentlysupportingMGSoperations.
Nineandahalfmonthsafterlaunch,inSeptember1999,MCOwastofireitsmainengine
toachieveanellipticalorbitaroundMars.Seefigure1.Thespacecraftwastothenskim
throughMarsupperatmosphereforseveralweeksinatechniquecalledaerobrakingto
reducevelocityandmoveintoacircularorbit.Frictionagainstthespacecraftssingle,5.5
metersolararraywastohaveslowedthespacecraftasitdippedintotheatmosphereeach
orbit,reducingitsorbitperiodfrommorethan14hoursto2hours.OnSeptember23,
1999theMCOmissionwaslostwhenitenteredtheMartianatmosphereonalowerthan
expectedtrajectory.
MPLisscheduledtolandonMarsonDecember3,1999,2to3weeksaftertheorbiter
wastohavefinishedaerobraking.Thelanderisaimedtowardatargetsectorwithinthe
edgeofthelayeredterrainnearMarssouthpole.
LikeMarsPathfinder,MPLwilldivedirectlyintotheMartianatmosphere,usingan
aeroshellandparachutescaleddownfromPathfindersdesigntoslowitsinitial
descent.Seefigures2and3.ThesmallerMPLwillnotuseairbags,butinsteadwill
relyononboardguidance,radar,andretrorocketstolandsoftlyonthelayeredterrain
nearthesouthpolarcapafewweeksaftertheseasonalcarbondioxidefrostshave
disappeared.Aftertheheatshieldisjettisoned,acamerawilltakeaseriesofpicturesof
thelandingsiteasthespacecraftdescends.
AsitapproachesMars,about10minutesbeforetouchdown,thelanderwillreleasethe
twoDeepSpace2microprobes.Oncereleased,theprojectileswillcollectatmospheric
databeforetheycrashatabout200meterspersecondandburythemselvesbeneaththe
Martiansurface.Themicroprobeswilltesttheabilityofverysmallspacecrafttodeploy
futureinstrumentsforsoilsampling,meteorologyandseismicmonitoring.Akey
instrumentwilldrawatinysoilsampleintoachamber,heatitanduseaminiaturelaserto
lookforsignsofvaporizedwaterice.
Alsoonboardthelanderisalightdetectionandranging(LIDAR)experimentprovided
byRussiasSpaceResearchInstitute.Theinstrumentwilldetectanddeterminethe
altitudeofatmosphericdusthazesandicecloudsabovethelander.Insidethe
instrumentisasmallmicrophone,furnishedbythePlanetarySociety,Pasadena,
California,whichwillrecordthesoundsofwindgusts,blowingdustandmechanical
operationsonboardthespacecraftitself.

10

Thelanderisexpectedtooperateonthesurfacefor60to90Martiandaysthroughthe
planetssouthernsummer(aMartiandayis24hours,37minutes).MPLwillusethe
MGSasadatarelaytoEarthinplaceoftheMCO.Themissionwillcontinueuntilthe
spacecraftcannolongerprotectitselffromthecoldanddarkoflengtheningnightsand
thereturnoftheMartianseasonalpolarfrosts.

Mars Climate Orbiter

Cruise
4 midcourse maneuvers
10Month Cruise

Mars Orbit Insertion and

Aerobraking

Launch
Delta 7425
Launch 12/11/98

Arrival 9/23/99
MOI is the only use of the main
[biprop] engine. The 16- minute burn
depletes oxidizer and captures
vehicle into 1314 hour orbit.

629 kg launch mass

Subsequent burn using hydrazine

thrusters reduce orbit period further.

Aerobraking to be completed prior

to MPL arrival [12/3/99].

Figure1

11

Mars Polar Lander

Cruise
RCS attitude control

Entry, Descent, and Landing

Arrival 12/3/99
Jettison Cruise Stage
Microprobes sep. from Cruise Stage
Hypersonic Entry (6.9 km/s)
Parachute Descent
Propulsive Landing
Descent Imaging [MARDI]

Four trajectory correction maneuvers, Site

Adjustment maneuver 9/1/99, Contingency
maneuver up to Entry 7 hr.

11 Month Cruise
Near-simultaneous
tracking w/ Mars Climate
Orbiter or MGS
during approach

Launch
Delta 7425
Launch 1/3/99
576 kg Launch Mass

Landed Operations
76 S Latitude, 195 W Longitude
Ls 256 (Southern Spring)
6090 Day Landed Mission
MVACS, LIDAR Science
Data relay via Mars Climate
Orbiter or MGS
Commanding via Mars Climate
Orbiter or direct-to-Earth high
gain antenna

Figure2

Entry/Descent/Landing Phase
GUIDANCE
SYSTEM

CRUISE RING SEPARATION / (L 10 min)

MICROPROBE SEPARATION
2300 km
6200 m/s
ATMOSPHERIC ENTRY (L 5 min)

INITIALIZATION

(L 15 min)

125 km
6900 m/s
PARACHUTE DEPLOYMENT (L 2 min)
8800 m
490 m/s

4600 km
HEATSHIELD JETTISON (L 110 s)

7500 m
250 m/s

5700 m/s

RADAR GROUND
ACQUISITION (ALTITUDE)

(L 50 s)
2500 m
85 m/s

Figure3

RADAR GROUND ACQUISITION

(DOPPLER) (L 36 s)
1400 m
80 m/s
LANDER SEPARATION /
POWERED DESCENT (L 35 s)
1300 m
80 m/s

TOUCHDOWN
2.5 m/s
SOLAR PANEL /

INSTRUMENT

DEPLOYMENTS

(L + 20 min)

12

2.MarsClimateOrbiter(MCO)Mishap
TheMCOhadbeenonatrajectorytowardMarssinceitslaunchonDecember11,1998.
Allspacecraftsystemshadbeenperformingnominallyuntilanabruptlossofmission
shortlyafterthestartoftheMarsOrbitInsertionburnonSeptember23,1999.
Throughoutspringandsummerof1999,concernsexistedattheworkinglevelregarding
discrepanciesobservedbetweennavigationsolutions.Residualsbetweentheexpected
andobservedDopplersignatureofthemorefrequentAMDeventswasnotedbutonly
informallyreported.AsMCOapproachedMars,threeorbitdeterminationschemeswere
employed.Dopplerandrangesolutionswerecomparedtothosecomputedusingonly
Dopplerorrangedata.TheDoppleronlysolutionsconsistentlyindicatedaflightpath
insertionclosertotheplanet.Thesediscrepancieswerenotresolved.
OnSeptember8,1999,thefinalplannedinterplanetaryTrajectoryCorrectionManeuver
4(TCM4)wascomputed.Thismaneuverwasexpectedtoadjustthetrajectorysuchthat
soonaftertheMarsorbitalinsertion(MOI)burn,thefirstperiapsealtitude(pointof
closestapproachtotheplanet)wouldbeatadistanceof226km.Seefigure4.Thiswould
havealsoresultedinthesecondperiapsealtitudebecoming210km,whichwasdesired
forthesubsequentMCOaerobrakingphase.TCM4wasexecutedasplannedon
September15,1999.
MarsorbitinsertionwasplannedonSeptember23,1999.Duringtheweeklong
timeframebetweenTCM4andMOI,orbitdeterminationprocessingbytheoperations
navigationteamindicatedthatthefirstperiapsedistancehaddecreasedtotherangeof
150170km
Duringthe24hoursprecedingMOI,MCObegantofeelthestrongeffectsofMars
gravitationalfieldandtrackingdatawascollectedtomeasurethisandincorporateitinto
theorbitdeterminationprocess.ApproximatelyonehourpriortoMOI,processingofthis
moreaccuratetrackingdatawascompleted.Basedonthisdata,thefirstperiapsealtitude
wascalculatedtobeaslowas110km.Theminimumperiapsealtitudeconsidered
survivablebyMCOis80km.
TheMOIenginestartoccurredat09:00:46(UTC)onSeptember23,1999.Allsystems
performednominallyuntilMarssoccultationlossofsignalat09:04:52(UTC),which
occurred49secondsearlierthanpredicted.Signalwasnotreacquiredfollowingthe21
minutepredictedoccultationinterval.Exhaustiveattemptstoreacquiresignalcontinued
throughSeptember25,1999,butwereunsuccessful.
OnSeptember27,1999,theoperationsnavigationteamconsultedwiththespacecraft
engineerstodiscussnavigationdiscrepanciesregardingvelocitychange(V)modeling
issues.OnSeptember29,1999,itwasdiscoveredthatthesmallforcesVsreportedby
thespacecraftengineersforuseinorbitdeterminationsolutionswaslowbyafactorof
4.45(1poundforce=4.45Newtons)becausetheimpulsebitdatacontainedintheAMD
filewasdeliveredinlbsecinsteadofthespecifiedandexpectedunitsofNewtonsec.
13

Finally,afterthefactnavigationestimates,usingallavailabledatathroughlossofsignal,
withcorrectedvaluesforthesmallforcesVs,indicatedaninitialperiapsis(lowest
pointoforbit)of57kmwhichwasjudgedtoolowforspacecraftsurvival.

Schematic MCO Encounter Diagram

Not to scale
Estimated trajectory
and AMD Vs

Actual trajectory
and AMD Vs

ToEarth

Figure4

14

3.MethodofInvestigation
OnOctober15,1999,theAssociateAdministratorforSpaceScienceestablishedthe
NASAMCOMishapInvestigationBoard(MIB),withArtStephenson,Directorof
MarshallSpaceFlightCenter,Chairman.ThePhaseIMIBactivity,reportedherein,
addressesparagraph4.A,oftheletterestablishingtheMCOMIB(Appendix).
Specifically,paragraph4.A.requeststhattheMIBfocusonanyaspectsoftheMCO
mishapwhichmustbeaddressedinordertocontributetotheMarsPolarLanders
safelandingonMars.
ThePhaseIMishapInvestigationBoardmeetingswereconductedattheJetPropulsion
Lab(JPL)onOctober1822.MembersoftheJPL/LockheedMartinAstronauticsteam
providedanoverviewoftheMCOspacecraft,operations,navigationplan,andthe
softwarevalidationprocess.Thediscussionwasallowedtotransitiontoanysubjectthe
Boarddeemedimportant,sothatmanyissueswerecoveredingreatdepthinthese
briefings.
BriefingswerealsoheldontheMPLsystems,withemphasisontheinterplanetary
trajectorycontrolandtheEntry,Descent,andLandingaspectsofthemission.TheBoard
alsosentamembertoparticipateinMPLscriticaleventreviewforEntry,Descent,and
Landing(EDL)heldatLMADenveronOctober21.Severalsubstantialfindingswere
broughtbackfromthisreviewandincorporatedintotheBoardsfindings.Afocused
splintermeetingwasheldwiththeBoardsnavigationexpertsandtheJPLnavigation
teamonMCOandMPLquestionsandconcerns.Splintermeetingswerealsoheldwith
theJPLandLMApropulsionteamsandwiththeJPLMSP98projectscientists.
PriortotheestablishmentoftheMCOMIB,twoinvestigativeboardshadbeen
establishedbyJPL.BoththeNavigationFailureAssessmentTeamandtheJPLMishap
InvestigationBoardpresentedtheirdraftfindingstotheMCOBoard.
Therootcause,contributingcausesandobservationsweredeterminedbytheBoard
throughaprocessthatalternatedbetweenindividualbrainstormingandgroup
discussion.Inaddition,theBoarddevelopedMPLobservationsandrecommendations
notdirectlyrelatedtotheMCOmishap.
Anumberofcontributingcauseswereidentifiedaswellasnumberofobservations.The
focusofthesecontributingcausesandobservationswereonthosethatcouldimpactthe
MPL.RecommendationsfortheMPLweredevelopedandarepresentedinthisPhaseI
report.RecommendationsregardingchangingtheNASAprogramprocessestopreventa
similarfailureinthefuturearethesubjectofthePhaseIIportionoftheBoardsactivity
asdescribedinSection8ofthisreport.
TheMPLobservationscontainedinthisreportrefertoconditionsasofOctober22,1999,
anddonotreflectactionstakensubsequenttothatdate.

15

4. MarsClimateOrbiter(MCO)RootCauseandMars
PolarLander(MPL)Recommendations
Duringthemishapinvestigationprocess,specificpolicyisinplacetoconductthe
investigationandtoprovidekeydefinitionstoguidetheinvestigation.NASAProcedures
andGuidelines(NPG)8621Draft1,"NASAProceduresandGuidelinesforMishap
Reporting,Investigating,andRecordkeeping"providesthesekeydefinitionsforNASA
mishapinvestigations.NPG8621(Draft1)definesarootcauseas:Alongachainof
eventsleadingtoamishap,thefirstcausalactionorfailuretoactthatcouldhavebeen
controlledsystematicallyeitherbypolicy/practice/procedureorindividualadherenceto
policy/practice/procedure.Basedonthisdefinition,theBoarddeterminedthattherewas
onerootcausefortheMCOmishap.

MCORootCause
TheMCOMIBhasdeterminedthattherootcauseforthelossoftheMCOspacecraftwas
thefailuretousemetricunitsinthecodingofagroundsoftwarefile,SmallForces,
usedintrajectorymodels.Specifically,thrusterperformancedatainEnglishunitsinstead
ofmetricunitswasusedinthesoftwareapplicationcodetitledSM_FORCES(small
forces).TheoutputfromtheSM_FORCESapplicationcodeasrequiredbyaMSOP
ProjectSoftwareInterfaceSpecification(SIS)wastobeinmetricunitsofNewton
seconds(Ns).Instead,thedatawasreportedinEnglishunitsofpoundseconds(lbfs).
TheAngularMomentumDesaturation(AMD)filecontainedtheoutputdatafromthe
SM_FORCESsoftware.TheSIS,whichwasnotfollowed,definesboththeformatand
unitsoftheAMDfilegeneratedbygroundbasedcomputers.Subsequentprocessingof
thedatafromAMDfilebythenavigationsoftwarealgorithmtherefore,underestimated
theeffectonthespacecrafttrajectorybyafactorof4.45,whichistherequired
conversionfactorfromforceinpoundstoNewtons.Anerroneoustrajectorywas
computedusingthisincorrectdata.

MPLRecommendations:
TheBoardrecommendsthattheMPLprojectverifytheconsistentuseofunits
throughouttheMPLspacecraftdesignandoperation.TheBoardrecommendsasoftware
auditforSIScomplianceonalldatatransferredbetweentheJPLoperationsnavigation
teamandthespacecraftoperationsteam.

16

5. MarsClimateOrbiter(MCO)ContributingCauses
andMarsPolarLander(MPL)Recommendations
Section6ofNPG8621(Draft1)provideskeydefinitionsforNASAmishap
investigations.NPG8621(Draft1)definesacontributingcauseas:Afactor,eventor
circumstancewhichleddirectlyorindirectlytothedominantrootcause,orwhich
contributedtotheseverityofthemishap.Basedonthisdefinition,theBoarddetermined
thattherewere8contributingcausesthatrelatetorecommendationsfortheMarsPolar
Lander.

MCOContributingCauseNo.1:ModelingofSpacecraft
VelocityChanges
Angularmomentummanagementisrequiredtokeepthespacecraftsreactionwheels(or
flywheels)withintheirlinear(unsaturated)range.Thisisaccomplishedthroughthruster
firingsusingaprocedurecalledAngularMomentumDesaturation(AMD).Whenan
AMDeventoccurs,relevantspacecraftdataistelemeteredtotheground,processedby
theSM_FORCESsoftware,andplacedintoafilecalledtheAngularMomentum
Desaturation(AMD)file.TheJPLoperationsnavigationteamuseddataderivedfrom
theAngularMomentumDesaturation(AMD)filetomodeltheforcesonthespacecraft
resultingfromthesespecificthrusterfirings.Modelingofthesesmallforcesiscritical
foraccuratelydeterminingthespacecraftstrajectory.Immediatelyafterthethruster
firing,thevelocitychange(V)iscomputedusinganimpulsebitandthrusterfiringtime
foreachofthethrusters.Theimpulsebitmodelsthethrusterperformanceprovidedby
thethrustermanufacturer.Thecalculationofthethrusterperformanceiscarriedoutboth
onboardthespacecraftandongroundsupportsystemcomputers.Mismodelingonly
occurredinthegroundsoftware.
TheSoftwareInterfaceSpecification(SIS),usedtodefinetheformatoftheAMDfile,
specifiestheunitsassociatedwiththeimpulsebittobeNewtonseconds(Ns).Newton
secondsaretheproperunitsforimpulse(ForcexTime)formetricunits.TheAMD
softwareinstalledonthespacecraftusedmetricunitsforthecomputationandwas
correct.Inthecaseofthegroundsoftware,theimpulsebitreportedtotheAMDfilewas
inEnglishunitsofpounds(force)seconds(lbfs)ratherthanthemetricunitsspecified.
SubsequentprocessingoftheimpulsebitvaluesfromtheAMDfilebythenavigation
softwareunderestimatedtheeffectofthethrusterfiringsonthespacecrafttrajectorybya
factorof4.45(1poundforce=4.45Newtons).
DuringthefirstfourmonthsoftheMCOcruiseflight,thegroundsoftwareAMDfiles
werenotusedintheorbitdeterminationprocessbecauseofmultiplefileformaterrors
andincorrectquaternion(spacecraftattitudedata)specifications.Instead,theoperations
navigationteamusedemailfromthecontractortonotifythemwhenanAMD
desaturationeventwasoccurring,andtheyattemptedtomodeltrajectoryperturbationson

17

theirown,basedonthistiminginformation.Fourmonthswereusedtofixthefile
problemsanditwasnotuntilApril1999thattheoperationsteamcouldbeginusingthe
correctlyformattedfiles.Almostimmediately(withinaweek)itbecameapparentthat
thefilescontainedanomalousdatathatwasindicatingunderestimationofthetrajectory
perturbationsduetodesaturationevents.Thesefileformatandcontenterrorsearlyinthe
cruisemissioncontributedtotheoperationsnavigationteamnotbeingabletoquickly
detectandinvestigatewhatwouldbecometherootcause.
InApril1999,itbecameapparentthattherewassometypeofmismodelingoftheAMD
maneuvers.Inattemptingtoresolvethisanomaly,twofactorsinfluencedthe
investigation.First,therewaslimitedobservabilityofthetotalmagnitudeofthethrust
becauseoftherelativegeometryofthethrustersusedforAMDactivitiesandtheEarth
tospacecraftlineofsight.Thenavigationteamcanonlydirectlyobservethethrust
effectsalongthelineofsightusingthemeasurementsofthespacecraftsDopplershift.
InthecaseofMarsClimateOrbiter(MCO),themajorcomponentofthrustduringan
AMDeventwasperpendiculartothelineofsight.Thelimitedobservabilityofthedirect
effectofthethrusteractivitymeantasystematicerrorduetotheincorrectmodelingof
thethrustereffectswaspresentbutundetectedinthetrajectoryestimation.Second,the
primarycomponentofthethrustwasalsoperpendiculartothespacecraftsflightpath.
Seefigure4.InthecaseofMCO,thisperturbationtothetrajectoryresultedintheactual
spacecrafttrajectoryattheclosestapproachtoMarsbeinglowerthanwhatwasestimated
bythenavigators.

MPLRecommendation:
TheBoardrecommendsthatthesmallforcesmodelsusedforMPLbevalidatedto
assurethepropertreatmentofthemodeledforces,includingthrusteractivityusedfor
attitudecontrolandsolarradiationpressure.Additionally,severalothernavigation
methodsshouldbecomparedtotheprimenavigationmethodtohelpuncoverany
mismodeledsmallforcesonMPL

MarsClimateOrbiter(MCO)ContributingCauseNo.2:
KnowledgeofSpacecraftCharacteristics
Theoperationsnavigationteamwasnotintimatelyfamiliarwiththeattitudeoperations
ofthespacecraft,especiallywithregardtotheMCOattitudecontrolsystemandrelated
subsystemparameters.Thisunfamiliaritycausedtheoperationsnavigationteamto
performincreasednavigationanalysistoquantifyanorbitdeterminationresidualerror.
Theerrorwasmaskedbythelackofinformationregardingtheactualvelocitychange
(V)impartedbytheangularmomentumdesaturation(AMD)events.Alineofsight
errorwasdetectableintheprocessingofthetrackingmeasurementdata,butits
significancewasnotfullyunderstood.Additionally,aseparatenavigationteamwasused
fortheMCOdevelopmentandtestphase.Theoperationsnavigationteamcameonboard
shortlybeforelaunchanddidnotparticipateinanyofthetestingofthegroundsoftware.
TheoperationsnavigationteamalsodidnotparticipateinthePreliminaryDesignreview

18

norinthecriticaldesignreviewprocess.Criticalinformationonthecontroland
desaturationoftheMCOmomentumwasnotpassedontotheoperationsnavigation
team.

MPLRecommendation:
TheBoardrecommendsthattheMPLoperationsnavigationteambeprovidedwith
additionaltrainingandspecificinformationregardingtheattitudesubsystemsandany
othersubsystemwhichmayhaveanimpactontheaccuracyofnavigationsolutions.To
facilitatethis,aseriesfacetofacemeetingsshouldbeconductedwiththespacecraft
development,andoperationsteamstodisseminateupdatedinformationandtodiscuss
anomaliesfromthispointforward.LongtermonsitesupportofanLMAarticulationand
attitudecontrolsystem(AACS)personshouldbeprovidedtotheoperationsnavigation
teamoraJPLresidentAACSexpertshouldbebroughtontheteamtohelpfacilitate
bettercommunication.

MCOContributingCauseNo.3:TrajectoryCorrection
Maneuver(TCM5)
DuringtheMCOapproach,acontingencymaneuverplanwasinplacetoexecutean
MCOTrajectoryCorrectionManeuver(TCM)5toraisethesecondperiapsispassageof
theMCOtoasafealtitude.Foralowinitialperiapsis,TCM5couldalsohavebeenused
shortlybeforetheMarsOrbitInsertion(MOI)asanemergencymaneuvertoattaina
saferaltitude.ArequesttoperformaTCM5wasdiscussedverballyshortlybeforethe
MOIonboardprocedurewasinitiated,butwasneverexecuted.
SeveralconcernspreventedtheoperationsteamfromimplementingTCM5.Analysis,
tests,andprocedurestocommittoaTCM5intheeventofasafetyissuewerenot
completed,norattempted.Therefore,theoperationsteamwasnotpreparedforsucha
maneuver.Also,TCM5wasnotexecutedbecausetheMOImaneuvertimelineonboard
thespacecrafttookpriority.Thisonboardproceduredidnotallowtimefortheupload,
execution,andnavigationverificationofsuchamaneuver.Additionally,anychangeto
thebaselinedorbitscenariocouldhaveexceededthetimefortheMCOaerobraking
phasewhenMCOwasneededtosupportthecommunicationsoftheMPLspacecraft.
ThecriticalitytoperformTCM5wasnotfullyunderstoodbythespacecraftoperations
oroperationsnavigationpersonnel.
TheMPLmissionsequencealsocontainsacontingencyTCM5forafinalcorrection
oftheincomingtrajectorytomeettheentrytargetconditionsfortheMPLEntry,
Descent,andLanding(EDL)phase.TheMPLTCM5iscurrentlylistedasa
contingencymaneuver.ThisTCM5alsohasnotbeenexplicitlydeterminedasa
requiredmaneuverandthereisstillconfusionoverthenecessityandtheschedulingofit.

19

MPLRecommendation:
Theboardrecommendsthattheoperationsteamadequatelyprepareforthepossibilityof
executingTCM5.Maneuverplanningandschedulingshouldbebaselinedaswellas
specificcriteriafordecidingwhetherornotthemaneuvershouldbeexecuted.Thefull
operationsteamshouldbebriefedontheTCM5maneuverexecutionscenarioand
shouldbefullytrainedandpreparedforitsexecution.Ifpossible,anintegrated
simulationofthemaneuvercomputations,validation,anduplinkshouldbeperformedto
verifyteamreadinessandsufficienttimescheduling.Additionally,aTCM5leadshould
beappointedtodeveloptheprocessfortheexecutionandtestingofthemaneuverandto
addressthemultipledecisionprocessofperformingTCM5withrespecttotheEDL.

MCOContributingCauseNo.4:SystemsEngineeringProcess
OneoftheproblemsobservedbytheBoardonMCOwasthatthesystemsengineering
processdidnotadequatelytransitionfromdevelopmenttooperations.Therewerea
numberofopportunitiesforthesystemsengineeringorganizationtoidentifytheunits
problemleadingtomissionlossofMCO..Thelackofanadequatesystemsengineering
functioncontributedtothelackofunderstandingonthepartofthenavigationteamof
essentialspacecraftdesigncharacteristicsandthespacecraftteamunderstandingofthe
navigationchallenge.Italsoresultedininadequatecontingencypreparationprocessto
addressunpredictedperformanceduringoperations,alackofunderstandingofseveral
criticaloperationstradeoffs,anditexacerbatedthecommunicationsdifficultiesbetween
thesubsystemengineers(e.gnavigation,AACS,propulsion).
Forexample,theAngularMomentumDesaturation(AMD)eventsonMCOoccurred10
14timesmoreoftenthanwasexpectedbytheoperationsnavigationteam.Thiswas
becausetheMCOsolararraywasasymmetricalrelativetothespacecraftbodyas
comparedtoMarsGlobalSurveyorwhichhadsymmetricalsolararrays.Thisasymmetric
effectsignificantlyincreasedtheSuninduced(solarpressureinduced)momentum
builduponthespacecraft.Tominimizethiseffect,adaily180oflipwasbaselinedto
canceltheangularmomentumbuildup.Systemsengineeringtradestudiesperformed
laterdeterminedthatthissocalledbarbecuemodewasnotneededanditwasdeleted
fromthespacecraftoperationsplan.Unfortunately,thesesystemsengineeringdecisions
andtheirimpacttothespacecraftandthespacecrafttrajectorywerenotcommunicatedto
theoperationsnavigationteam.TheincreasedAMDeventsresultingfromthisdecision
coupledwiththefactthattheangularmomentum(impulse)datawasinEnglish,rather
thanmetric,unitscontributedtotheMCOmissionfailure.

MPLRecommendation:
TheBoardrecommendsthattheMPLprojectestablishandfullystaffasystems
engineeringorganizationwithrolesandresponsibilitiesdefined.Thisteamshould
concentrateontheTCM5andEDLactivities.TheyshouldsupportupdatingMPLrisk
assessmentsforbothEDLandMarsgroundoperations,andreviewthesystems

20

engineeringontheentireMPLmissiontoensurethattheMPLmissionisreadyfor
theEDLsequence.

MCOContributingCauseNo.5:CommunicationsAmong
ProjectElements
IntheMCOproject,andagainintheMPLproject,thereisevidenceofinadequate
communicationsbetweentheprojectelements,includingthedevelopmentand
operationsteams,theoperationsnavigationandoperationsteams,theproject
managementandtechnicalteams,andtheprojectandtechnicallinemanagement.
Itwasclearthattheoperationsnavigationteamdidnotcommunicatetheirtrajectory
concernseffectivelytothespacecraftoperationsteamorprojectmanagement.In
addition,thespacecraftoperationsteamdidnotunderstandtheconcernsofthe
operationsnavigationteam.TheBoardfoundtheoperationsnavigationteamsupporting
MCOtobesomewhatisolatedfromtheMCOdevelopmentandoperationsteams,aswell
asfromitsownlineorganization,byinadequatecommunication.Onecontributingfactor
tothislackofcommunicationmayhavebeentheoperationsnavigationteams
assumptionthatMCOhadMarsGlobalSurveyor(MGS)heritageandtheresulting
expectationthatmuchoftheMCOhardwareandsoftwarewassimilartothatonMGS.
Thisapparentlycausedtheoperationsnavigationteamtoacquireinsufficienttechnical
knowledgeofthespacecraft,itsoperation,anditspotentialimpacttonavigation
computations.Forexample,theoperationsnavigationteamdidnotknowuntillongafter
launchthatthespacecraftroutinelycalculated,andtransmittedtoEarth,velocitychange
datafortheangularmomentumdesaturationevents.Anearlycomparisonofthese
spacecraftgenerateddatawiththetrackingdatamighthaveuncoveredtheunitsproblem
thatultimatelyledtothelossofthespacecraft.Whenconflictsinthedatawere
uncovered,theteamreliedonemailtosolveproblems,insteadofformalproblem
resolutionprocessessuchastheIncident,Surprise,Anomaly(ISA)reportingprocedure.
Failingtoadequatelyemploytheproblemtrackingsystemcontributedtothisproblem
slippingthroughthecracks.
AsplintermeetingbetweensomemembersoftheBoardandtheoperationsnavigation
teamillustratedthefactthattherewasinadequatecommunicationbetweentheoperations
navigationteamandmissionoperationsteams.WhiletheBoardwasnotifiedofpotential
changesintheMPLlandingsite,itwasdiscoveredthatthisknowledgewasnotfully
conveyedtotheentireMPLoperationsnavigationteam.Inadequatesystemsengineering
supportexacerbatedtheisolationofthenavigationteam.Arobustsystemsengineering
teamcouldhavehelpedimprovecommunicationbetweentheoperationsnavigationteam
andother,navigationcriticalsubsystems(e.g.propulsion,AACS).Systemsengineering
supportwouldhaveenhancedtheoperationsnavigationteamsabilitiestoreachcritical
decisionsandwouldhaveprovidedoversightinnavigationmissionassurance.

21

Theoperationsnavigationteamcouldhavebenefitedfromindependentpeerreviewsto
validatetheirnavigationanalysistechniqueandtoprovideindependentoversightof
thetrajectoryanalyses.
DefensivemechanismshavealsodevelopedbetweentheteammembersonMPLasa
resultoftheMCOfailure.Thisiscausinginadequatecommunicationacrossproject
elementsandafailuretoelevateconcernswithfullendtoendproblemownership.

MPLRecommendations:
TheboardrecommendsthattheMPLprojectshouldstresstotheprojectstaffthat
communicationiscriticalandempowerteammemberstoforcefullyelevateanyissue,
keepingtheoriginatorintheloopthroughformalclosure.Projectmanagementshould
establishapolicyandcommunicateittoallteammembersthattheyareempoweredto
forcefullyandvigorouslyelevateconcernsashigh,eitherverticallyorhorizontallyinthe
organization,asnecessarytogetattention.Thispolicyshouldbeconstantlyreinforcedas
ameansformissionsuccess.
TheMPLprojectshouldincreasetheamountofformalandinformalfacetoface
communicationswithallteamelementsincludingscience,navigation,propulsion,etc.
andespeciallyforthoseelementsthathavecriticalinterfaceslikenavigationand
spacecraftguidanceandcontrol.(e.g.colocationofanavigationteammemberwiththe
spacecraftguidanceandcontrolgroup).
Theprojectshouldestablisharoutineforumforinformalcommunicationbetweenall
teammembersatthesametimesoeveryonecanhearwhatishappening.(e.g.a15
minutestanduptagupmeetingeverymorning).
TheprojectandJPLmanagementshouldencouragetheMPLteamtobeskepticsand
raiseallconcerns.AllmembersoftheMPLteamshouldtakeconcernspersonallyand
seethattheyreceiveclosurenomatterwhatittakes.
Theoperationsnavigationteamshouldimplementandconductaseriesofindependent
peerreviewsinsufficienttimetosupportMPLmissioncriticalnavigationevents.

TheBoardalsorecommendsthattheMPLprojectassignamissionsystemsengineeras
soonaspossible.Thismissionsystemsengineerwouldprovidethesystemsengineering
bridgebetweenthespacecraftsystem,theinstrumentsystemandtheground/operations
systemtomaximizetheprobabilityofmissionsuccess.

MCOContributingCauseNo.6:OperationsNavigationTeam
Staffing
TheBoardfoundthatthestaffingoftheoperationsnavigationteamwaslessthan
adequate.DuringthetimeleadinguptothelossoftheMCO,theMarsSurveyor

22

OperationsProject(MSOP)wasrunning3missionssimultaneously(MGS,MCO,MPL).
Thistendedtodilutethefocusonanyonemission,suchasMCO.Duringthetimebefore
Marsorbitinsertion(MOI),MCOnavigationwashandledbythenavigationteamlead
andtheMCOnavigator.DuetothelossofMCO,MPListohavethreenavigators,but
onlytwowereonboardatthetimeoftheBoardsmeetingsduringtheweekofOct.18
22,1999.TheBoardwastoldthat24hour/daynavigationstaffingisplannedforabrief
periodbeforeMPLentry,descent,andlanding(EDL).Suchcoveragemaybedifficult
evenforateamofthreenavigatorsandcertainlywasnotpossibleforthesinglenavigator
ofMCO.

MPLRecommendation:
TheBoardrecommendsthattheoperationsnavigationstaffbeaugmentedwith
experiencedpeopletosupporttheMPLEDLsequence.TheMPLprojectshouldassign
andtrainathirdnavigatortotheoperationsteamtosupporttheEDLactivitiesassoon
aspossible.Inaddition,theoperationsnavigationteamshouldidentifybackuppersonnel
thatcouldbemadeavailabletoserveinsomeofthecriticalrolesintheeventthatoneof
thekeynavigatorsbecomesillpriortotheEDLactivity.
TheBoardalsorecommendsthattheMPLprojectpreparecontingencyplansfor
backingupkeypersonnelformissioncriticalfunctionsinanyareaoftheProject.

MCOContributingCauseNo.7: TrainingofPersonnel
TheBoardfoundseveralinstancesofinadequatetrainingintheMCOproject.The
operationsnavigationteamhadnotreceivedadequatetrainingontheMCOspacecraft
designanditsoperations.SomemembersoftheMCOteamdidnotrecognizethe
purposeandtheuseoftheISA.Thesmallforcessoftwaredevelopmentteamneeded
additionaltraininginthegroundsoftwaredevelopmentprocessandintheuseand
importanceoffollowingtheMissionOperationsSoftwareInterfaceSpecification(SIS).
TherewasinadequatetrainingoftheMCOteamontheimportanceofanacceptable
approachtoendtoendtestingofthesmallforcesgroundsoftware.Therewasalso
inadequatetrainingontherecognitionandtreatmentofmissioncriticalsmallforces
groundsoftware.

MPLRecommendation:
TheBoardrecommendsthattheMPLoperationsnavigationteamreceiveproper
traininginthespacecraftdesignandoperations.IdentifytheMPLmissioncritical
groundsoftwareandensurethatallsuchgroundsoftwaremeetstheMPLsoftware
developmentplans.EnsurethattheentireMPLteamistrainedontheISAProcessand
itspurposeemphasizea"MissionSafetyFirst"attitude.Encourageanyissuetobe
writtenupasanISA.ReviewallcurrentanomaliesandgenerateappropriateISAs.

23

MCOContributingCauseNo.8:VerificationandValidation
Process
SeveralverificationandvalidationprocessissueswereuncoveredduringtheBoards
reviewoftheMCOprogramthatshouldbenoted.TheSoftwareInterfaceSpecification
(SIS)wasdevelopedbutnotproperlyusedinthesmallforcesgroundsoftware
developmentandtesting.Endtoendtestingtovalidatethesmallforcesgroundsoftware
performanceanditsapplicabilitytothespecificationdidnotappeartobeaccomplished.
Itwasnotclearthatthegroundsoftwareindependentverificationandvalidationwas
accomplishedforMCO.Theinterfacecontrolprocessandtheverificationofspecific
groundsysteminterfaceswasnotcompletedorwascompletedwithinsufficientrigor.

MPLRecommendation:
TheBoardrecommendsthattheMPLprojectdevelopasystemverificationmatrixforall
projectrequirementsincludingallInterfaceControlDocuments(ICDs).TheMPLteam
shouldreviewthesystemverificationmatrixatallremainingmajorreviews.TheMPL
projectshouldrequireendusersatthetechnicalleveltosignoffonthegroundsoftware
applicationsandproductsandtheMPLprojectshouldreviewallgroundsoftware
applications,includingallnewandreusedsoftwarepackagesforapplicabilityandcorrect
datatransfer.

24

6. MarsClimateOrbiter(MCO)Observationsand
Recommendations
Section6ofNPG8621(Draft1)provideskeydefinitionsforNASAmishap
investigations.NPG8621(Draft1)definesasignificantobservationas:Afactor,event
orcircumstanceidentifiedduringtheinvestigationwhichwasnotcontributingtothe
mishap,butifleftuncorrected,hasthepotentialtocauseamishap...orincreasethe
severityshouldamishapoccur.Basedonthisdefinition,theBoarddeterminedthat
therewere10observationsthatrelatetorecommendationsfortheMLP.

MCOObservationNo.1:TrajectoryMarginforMarsOrbit
Insertion
AstheMCOproceededthroughcruisephaseforthesubsequentMOIandaerobraking
phases,themarginsneededtoensureasuccessfulorbitcaptureerodedovertime.During
thecruisephaseandimmediatelyprecedingMOI,inadequatestatisticalanalyseswere
employedtofullyunderstandthedispersionsofthetrajectoryandhowthesewould
impactthefinalMOIsequence.Thisresultedinamisunderstandingoftheactualvehicle
trajectory.Asdescribedpreviously,theactualtrajectorypathresultedinaperiapsismuch
lowerthanexpected.Inaddition,TCM5contingencyplans,intheeventofananomaly,
werenotadequatelyworkedoutaheadoftime.Theabsenceofplanning,tests,and
commitmentcriteriafortheexecutionofTCM5mayhaveplayedasignificantrolein
thedecisiontonotchangetheMCOtrajectoryusingtheTCM5maneuver.Thefailureto
executeTCM5isdiscussedasacontributingcauseofthemishap.Spacecraftpropellant
reservesandschedulemarginsduringtheaerobrakingphaseswerenotusedtomitigate
theriskofuncertaintiesintheclosestapproachdistanceatMOI.

MPLRecommendations:
TheBoardrecommendsthattheMPLprojectimprovethedataanalysisproceduresfor
fittingtrajectorydatatomodels,thattheyimplementanindependentnavigationpeer
panelandnavigationadvisorygroupasameanstofurthervalidatethemodelstothe
trajectorydata,andthattheyengagetheentireMPLteaminTCMandEntry,Descent,
andLanding(EDL)planning.

MCOObservationNo.2:IndependentReviews
TheBoardnotedthatanumberofreviewstookplacewithouttheproperrepresentationof
keypersonnel;operationsnavigationpersonneldidnotattendthespacecraftPreliminaryand
CriticalDesignReviews.Attendanceoftheseindividualsmayhaveallowedtheflowof
pertinentandapplicablespacecraftcharacteristicstotheoperationsnavigationteam.

25

Knowledgeofthesecharacteristicsbytheoperationsnavigationmayhavehelped
themresolvetheproblem.
Keymodelingissuesweremissedintheinterpretationoftrajectorydatabytheoperations
navigationteam.Theabsenceofarigorous,independentnavigationpeerreviewprocess
contributedtotheseissuesbeingmissed.

MPLRecommendations:
Provideforoperationsnavigationdisciplinepresenceatmajorreviews.Ensuresubsystem
specialistsattendmajorreviewsandparticipateintransferoflessonslearnedtothe
operationsnavigationteamandothers.Implementaformalpeerreviewprocessonall
missioncriticalevents,especiallycriticalnavigationevents.

MCOObservationNo.3:ContingencyPlanningProcess
InadequatecontingencyplanningforTCM5wasobservedtoplayapartintheMCO
failure.TheMCOoperationalcontingencyplansforTCM5werenotwelldefinedand
orcompletelyunderstoodbyallteammembersontheMCOoperationalteam.
TheMCOprojectdidnothaveadefinedsetofGoNoGocriteriaforusingTCM5.
Therewasnoprocessinplacetoreviewtheevaluationanddecisioncriteriabythe
projectandsubsystemengineersbeforecommitmenttoTCM5.Pollingoftheteamby
theMCOFlightOperationsManagershouldestablishaclearcommitmentfromeach
subsystemleadthatheorshehasreviewedtheappropriatedataandbelievesthatthe
spacecraftisintheproperconfigurationfortheevent.

MPLRecommendations:
Contingencyplansneedtobedefined,theproductsassociatedwiththecontingencies
fullydeveloped,thecontingencyproductstestedandtheoperationalteamtrainedonthe
useofthecontingencyplansandontheuseoftheproducts.Sinceallpossible
contingencyplanscannotbedeveloped,asystematicassessmentofallpotentialfailure
modesmustbedoneasabasisforthedevelopmentoftheprojectcontingencyplans.The
MPLteamshouldestablishafirmsetofGonogocriteriaforeachcontingency
scenarioandtheindividualmembersoftheoperationsteamandsubsystemexperts
shouldbepolledpriortocommittingtotheevent.

MCOObservationNo.4:TransitionfromDevelopmentto
Operations
TheBoardfoundthattheoverallprojectplandidnotprovideforacarefulhandoverfrom
thedevelopmentprojecttotheverybusyoperationsproject.MCOwasthefirstJPL

26

missiontotransitionaminimalnumberofthedevelopmentteamintoamultimission
operationsteam.VeryfewJPLpersonnelandnoMCOnavigationpersonnel,
transitionedwiththeproject.Furthermore,MCOwasthefirstmissiontobesupportedby
themultimissionMSOPteam.
DuringthemonthsleadinguptoMCOMOI,theMSOPteamhadsomekeypersonnel
vacanciesandachangeintopmanagement.Theoperationsnavigationpersonnelin
MSOPwereworkingMGSoperations,whichhadexperiencedsomeinflightanomalies.
TheywereexpectingMCOtocloselyresembleMGS.Theyhadnotbeeninvolvedinthe
initialdevelopmentofthenavigationplananddidnotshowownershipoftheplan,which
hadbeenhandedofftothembytheMCOdevelopmentteam.TheMSOPhadnosystems
engineeringandnomissionassurancepersonnelwhomighthaveactedasanadditional
setofeyesintheimplementationoftheprocess.
ItshouldbenotedthattheMPLnavigationdevelopmentengineerdidtransitionto
operations.

MPLRecommendations:
IncreasetheMPLoperationsandoperationsnavigationteamsasappropriate.Augment
theteamsbyrecallingkeymembersofthedevelopmentteamandspecialistsfromthe
lineorganization.ConsidermorecollocationofJPL/LMApersonnelthroughEDL.
ConductarigorousreviewofthehandofffromtheJPLoperationsnavigationteamto
theLMAEDLteam,particularlytheICDandallcriticalevents.

MCOObservationNo.5:MatrixManagement
TheBoardobservedthatlineorganizations,especiallythatoftheoperationsnavigation
team,werenotsignificantlyengagedinprojectrelatedactivity.Inthecaseofnavigation,
theBoardobservedlittleevidenceofcontactbetweenlinesupervisionandnavigators
supportingtheproject.

MPLRecommendation:
Expeditiouslyinvolvelinemanagementinindependentlyreviewingand
followingthroughtheworkremainingtoachieveasuccessfulMPLlanding.

MCOObservationNo.6:MissionAssurance
TheBoardobservedtheabsenceofamissionassurancemanagerinMSOP.Itwasfeltthat
suchapresenceearlierintheprogrammighthavehelpedtoimproveproject
communication,insurethatprojectrequirementsweremet.Itemsthatthemission
assurancemanagercouldhaveaddressedforMCOincludedensuringthattheAMDfile
mettherequirementsoftheSISandtrackingISAresolutions.Themissionassurance

27

managerwouldpromotethehealthyquestioningofwhatcouldgowrong.TheBoard
explicitlyheardanintentiontofillthemissionassurancepositionforMPL,butthis
hadnothappenedasofOctober22,1999.

MPLRecommendation:
AssignamissionassurancemanagerinMSOPassoonaspossible.

MCOObservationNo.7:ScienceInvolvement
TheparadigmfortheMarsSurveyorprogramisacapabilitiesdrivenmissioninwhichall
elements,includingscience,weretradedtoachieveprojectobjectiveswithintheoverall
constraintsofcostandschedule.Successofsuchmissionsrequiresfullinvolvementof
themissionsciencepersonnelinthemanagementprocess.Inaddition,sciencepersonnel
withrelevantexpertiseshouldbeincludedinalldecisionswhereexpertknowledgeof
Marsisrequired.WhilethiswasgenerallythecasefortheMars98program,such
expertswerenotfullyinvolvedinthedecisionsnottoperformTCM5priortoMarsorbit
insertion.

MPLRecommendation:
FullyinvolvetheProjectScientistinthemanagementprocessfortheremainderofthe
MPLmission,includingdecisionsrelatingtoEntry,Descent,andLanding.

MCOObservationNo.8:NavigationCapabilities
JPLsnavigationofinterplanetaryspacecrafthasworkedwellfor30years.Inthecaseof
MCOtherewasawidespreadperceptionthatOrbitingMarsisroutine.Thisperception
resultedininadequateattentiontonavigationriskmitigation.

MPLRecommendation:
MPLprojectpersonnelshouldquestionandchallengeeverythingeventhosethings
thathavealwaysworked.JPLtopmanagementshouldprovidethenecessaryemphasis
tobringaboutaculturalchange.

MCOObservationNo.9:ManagementofCriticalFlight
Decisions
Duringitsdeliberations,theBoardobservedsignificantuncertaintyanddiscussionsabout
suchthingsastheprojectsplanfortrajectorycorrectionmaneuvers(TCMs)andthe
plannedprimaryandalternatelandingsitesforMPL.PlanningforTCM5onMCOwas
inadequate.TCM5forMPLwasstillbeingdescribedasacontingencymaneuverduring

28

theBoardsdeliberations.TheBoardalsonotesevidenceofdelayeddecisionsatthe
October21,1999,MPLCriticalEventsReviewforEntry,Descent,andLanding.

MPLRecommendation:
Requiretimely,disciplineddecisionsinplanningandexecutingtheremainderof
theMPLmission.

MCOObservationNo.10: AnalyzingWhatCouldGoWrong
TheBoardobservedwhatappearedtobethelackofsystematicanalysesofwhat
couldgowrongwiththeMars98projects.Forexample,theBoardobservednofault
treeorotherapriorianalysesofwhatcouldgowrongwithMCOorMPL.

MPLRecommendation:
ConductafaulttreeanalysisfortheremainderoftheMPLmission;followuponthe
results.Considerusinganexternalfacilitator;e.g.,fromnuclearindustryoracademia,if
thenecessaryexpertiseintheaprioriuseoffaulttreeanalysisdoesnotexistatJPL.

29

7. MarsPolarLander(MPL)Observations
andRecommendations
AspartoftheMCOPhaseIactivity,theBoarddevelopedeightMPLobservationsand
recommendationsnotdirectlyrelatedtotheMCOmishap.

MPLObservationNo.1:UseofSupplementalTrackingData
Types
Theuseofsupplementaltrackingdatatypestoenhanceorincreasetheaccuracyofthe
MPLnavigationsolutionswasdiscussed.OnedatatypelistedintheMPLMission
PlanningDatabookasarequirementtomeettheEntryDescentLanding(EDL)target
conditiontoaperformanceofbetterthan95percentistheNearSimultaneousTracking
(NST).Additionaldatatypesdiscussedweretheuseofathreewaymeasurementanda
differencerangeprocess.Thesedatatypeswouldbeusedindependentlytoassessthe
twowaycoherentmeasurementdatatypes(rangeandDoppler)baselinedbytheprime
operationsnavigationteam.DuringthepresentationstotheMIB,itwasstatedthatthe
MPLnavigationteamleadwouldbeinvolvedinthedetailedanalysisoftheNSTdata.
TheapplicationofaNSTdatatypeisrelativelynewtotheMPLmissionnavigation
procedure.ThesedatatypeshavenotbeenpreviouslyusedforMCOorMPLnavigation.
TheresultsofthenewdatatypesinadditiontorangeandDoppleronlysolutionscould
potentiallyaddtotheuncertaintyofthebestestimateofthetrajectoryattheEDL
conditions.

MPLRecommendation:
IdentifytherequirementfortheuseoftheNST,3way,anddifferencerange.Determine
iftheEDLtargetconditionscanbemetwithoutthem.Anindependentteamshouldbe
responsiblefortheprocessingandassessmentofthesealternativetrackingschemes.A
processshouldbedevelopedtoutilizethesedatatypesasacrosscheckofthecurrent2
waycoherentmethod.EnsurethattheNSTprocessisstreamlinedandwellunderstoodas
itisincorporatedintothenominaloperations.IfNSTisnecessary,focusworksoasto
notaffectotherroutinenavigationoperations.

MPLObservationNo.2:StarCameraAttitudeManeuver
(SCAM)
PriortoEntry,DescentandLanding(EDL),amultihourattitudecalibrationisplanned
onMPL.ThissocalledStarCameraAttitudeManeuver(SCAM)willreorientthe
spacecrafttoprovideoptimalobservationofstarsinthestarcamera.Thepurposeofthis
maneuveristocalibratethegyrodriftbiasanddeterminethevehicleattitudetoalevel
ofperformancenecessarytoinitiatetheEDLmaneuversequence.Thespecificattitude
requiredtosuccessfullyperformtheSCAMresultsinalossofspacecrafttelemetrydue

30

tothefactthattheMPLantennaispointedawayfromEarth.Currently,theexacttiming
oftheplannedSCAMactivityhasnotbeenfinalized.

MPLRecommendation:
TheMPLflightoperationsteamshouldestablishdefinitiveSCAMrequirements,
especiallytheattitudeaccuracyneededpriortoEDLandthelengthoftimethatMPL
isrequiredintheSCAMattitude.Clearoperationsscenariosshouldbedevelopedand
specificcontingencyoperationsproceduresshouldbedeveloped.

MPLObservationNo.3:VerificationandValidation(V&V)
ofLanderEntryStateFile
Althoughtheboardwasinformedthataplanexisted,thefinalendtoendverificationand
validationoftheEntryDescentLandingoperationalprocedureshadnotbeencompleted
whentheBoardreviewedtheproject.Thiscannotbecompleteduntilaftertheground
softwarehassuccessfullycompletedacceptancetesting.Moreover,thegenerationand
subsequentuseoftheLanderEntryStateFile(LESF)hasnotbeentested.Thedatainthe
LESFisusedtoupdatetheonboardestimateofMarsrelativepositionandvelocityjust
priortoentryinterface.ApparentlythisisarelativelynewprocedureforJPLandthus
shouldreceivefocusedattention.

MPLRecommendation:
TheBoardrecommendsthattheMPLteamperformanendtoendV&VtestofEDL
includinguseoftheLESF.Coordinatetransformationsandrelatedequationsusedinthe
generationofthisfileshouldbecheckedcarefully.Theendtoendtestshouldinclude
simulateduplinksoftheLESFtothespacecraftandpropagationofthesimulatedstate
vectortolandingina6degreeoffreedomsimulationliketheSimulationTest
Laboratory.Itmaybebeneficialtotestitmorethanoncewithperhapsdifferent
scenariosoruplinkedstatevectors.Relatedtothisissueistheneedtohaveabaselined
spacecrafttimelineespeciallywhenentryinterfaceisapproaching.Anyspacecraft
maneuvers,e.g.,SCAMmaneuvers,fromshortlybeforeuplinkoftheLESFuntilentry
interfaceneedtobewellplannedaheadoftime,i.e.,modeledbythenavigators,sothat
theonboardnavigationstateatentryinterfacewillbeasaccurateaspossible.
Ifpossible,provideforthecapabilitytouseapreliminarynavigationsolutionforEDL
navigationinitializationincaseofatemporaryuplinkproblem,i.e.,uplinkanLESF
filebeforeitisreallyneededsothatifananomalyoccursinthatprocess,theonboard
EDLnavigationsystemwillhavesomethingreasonabletoworkwith,albeitperhaps
notasaccurateasdesired.

31

MPLObservationNo.4:RolesandResponsibilitiesof
Individuals
InthewakeoftheMCOlossandthesubsequentaugmentationoftheMPLteam,the
BoardobservedthatrolesandresponsibilitiesofsomeindividualsinMSOPareunclear.
ArecurringthemeintheBoardsdeliberationswasoneofWhosincharge?Another
suchrecurringthemewasoneofWhosthemissionmanager?TheBoardperceived
hesitancyandwaveringonthepartofpeopleattemptingtoanswerthisquestion.One
answerwasthattheFlightOperationsManager(FOM)wasactinglikeamission
manager,butisnotactuallydesignatedassuch.

MPLRecommendation:
TheBoardrecommendsthattheMPLprojectclarifyrolesandresponsibilitiesforall
individualsontheteam.AssignapersontheroleofmissionmanagerforMPLand
ensurethattheentireteamunderstandstheleadershiprolethatthispersonisempowered
toprovidetotheMPLteam.

MPLObservationNo.5:ColdFiringofThrusters
Hydrazinehasphysicalpropertiesthatareverysimilartowater.Hydrazineisa
monopropellantthatwillbeusedinthrusterstoslowtheMPLspacecraftfromabout75
80meters/secondtoitslandingvelocityaround2.5meters/second.Thisisaccomplished
bysimultaneouslypulsemodefiringtwelve(12)parallelcatalyticthrusters.Thekey
concernisthefreezingpointofhydrazine.Hydrazinefreezesaround1to2C,
dependingontheexactenvironmentalconditionsandhydrazinespurity.Furthermore,
thespontaneouscatalyst(i.e.,initiateshydrazinedecompositionatroomtemperature)
usedinallthrustersflyingtoday,losesspontaneousreactivityasthecatalystbed
temperatureisloweredbelow7C.Ifthecatalystbedisverycold(i.e.wellbelow0C),
thentherewillbelongignitiondelayswhenthethrustersarecommandedtofire.The
resultsoftheseextremelycoldandlongignitiondelayfiringscouldproducehigh
pressurespikesandevenpossiblydetonations.Asaminimum,thecoldcatalystbed
inducedignitiondelaysandtheresultingirregular,pulsesonstartup,couldseriously
impactMPLdynamicsandpotentiallythestabilityofthevehicleduringtheterminal
descentoperations,possiblyleadingtoanonuprighttouchdown.
AdditionalconcernexistsastowhentheEDLoperationsteamplanstoturnonthe
heatersonthepropellantlinesfeedingthehydrazinethrusters.Theouterlinesandthe
thrusterswillhavebeencoldsoakingduringthe11monthtriptoMars.Ifanyof
theselinesarecoldenough(wellbelow0C),thenthehydrazinemightfreezewhen
bledintothethrustervalves.Ifthisoccurs,thentherewillbenoimpulsewhenthe
thrustersarecommandedtofire.

32

Itwasstatedbytheprojectoperationsmanagerthatall12thrusters(operatingat267
Newtonseach)mustalloperateascommanded.Therefore,theabovedescribedthermal
deficienciesshouldbeamajorconcernfortheMPLprojectteam.

MPLRecommendations
TheBoardrecommendsthattheMPLteamexaminethethermalanalysisanddetermine
whentheheatersonthelinesfeedingthethrustersshouldbeturnedontoensure
adequate,stableliquidflowwithsufficientpositivemargins.TheBoardalsosuggeststhat
theMPLteamshouldconsidertheuseofveryshortcatalystbedthermalpreconditioning
pulsesduringlanderpropulsionsystemutilization(i.e.,startup)toinsureuniformpulse
firingduringterminaldescent.

MPLObservationNo.6:MPLTerminalDescentManeuver
TheMPLterminaldescentmaneuverwillusesimultaneoussoftpulsemodefiringsof12
monopropellanthydrazinethrustersoperatingat267Newtonsofthrusteach.Allthese
thrustersmustoperateinunisontoensureastabledescent.Thistypeofpowereddescent
maneuverhasalwaysbeenconsideredtobeverydifficultandstressingforaplanetary
explorationsoftlanding.Hence,inthelast35yearsofplanetaryexploration,MPListhe
firstuserofthissoftpulsedthrustsoftlandingtechnique.
Theconcernhasbeenthatthefeedlinehydraulicsandwaterhammereffectscouldbe
verycomplexandinteractive.Thisissuecouldbefurtheraggravatedbyfuelslosh,
unevenfeedingofpropellantfromthetwotanksandpossiblecenterofgravity
mismatchonthevehicle.Additionalcomplicationscouldresultfromnonuniform
exhaustplumeimpingementonthelanderlegsstickingbelowthethrusternozzlesdue
toanyunevenpulsefirings.
Itshouldberecognizedthatunderextremeworstcaseconditionsforfeedline
interactions,itispossiblethatsomethrusterscouldproducenearzerothrustand
somecouldproducenearlytwicetheexpectedthrustwhencommandedtooperate.

MPLRecommendation:
ItwasstatedmanytimesbytheMPLprojectteamduringthereviewswiththeBoard,
thatavastnumberofsimulations,analysesandrigorousrealistictestswereallcarefully
conductedduringthedevelopmentprogramtoaccountforallthesefactorsduringthe
propulsivelandingmaneuver.
However,becauseoftheextremecomplexityofthislandingmaneuver,theEDL
teamshouldcarefullyreverifythatalltheabovedescribedpossibleeffectshavebeen
accountedforintheterminalmaneuverstrategiesandcontrollawsandtheassociated
softwareforEDLoperations.

33

MPLObservationNo.7:DecisionMakingProcess
DiscussionswithMPLteammembersrevealeduncertaintyaboutmissioncritical
decisionsthatinhibitedthemfromdoingtheirjobinatimelymanner.TheBoard
observedthattherewasdiscussionaboutthelandingsiteforMPLatthetimeofour
meetingsatJPL.Accordingtoplan,therewasconsiderationofmovingtothebackupsite
basedonnewinformationfromMGSregardinglandingsitecharacteristics.Some
elementsoftheProjectteam,e.g.,somemembersoftheoperationsnavigationteam,
werenotinformedofthisnewinformationorthefactthatthelandingsitewasbeing
reconsidered.Therealsowasapparentlyuncertaintyabouttheprocessforaddressingthis
timecriticaldecisionandaboutwhenitwouldbemade.

MPLRecommendation:
Communicatewidelytheneedfortimelydecisionsthatenablethevariouselementsof
theProjecttoperformtheirjobs.Establishaformaldecisionneeddatetrackingsystem
thatiscommunicatedtotheentireteam.Thissystemwouldidentifythelatestdecision
needdateandtheimpactofnotmakingthedecision.AllelementsoftheProjectshould
provideinputforestablishingthesedatesandbeinformedofthedecisionschedules.
AssignanoverallMissionManagerresponsibleforthesuccessoftheentiremission
fromspacecrafthealthtoreceiptofsuccessfulsciencedata.

MPLObservationNo.8:LanderScience
TheBoardwasinformedthatpreparationsfortheLanderscienceprogramwereinan
incompletestateatthetimeoftheBoardsmeetingduetotheimpactsresultingfromthe
lossoftheMCO.TheredirectionofresourcesduemainlytothelossofMCOcausedthe
scienceteamtobecomefurtherbehindinpreparationforMPLscienceoperations.Since
thelandedscienceprogramislimitedtoaboutthreemonthsbytheshortsummerseason
neartheMartianSouthPole,maximumsciencereturnrequiresfullreadinessforscience
operationspriortoEDL.Severaladditionalmanagerswerebeingassignedtoaddress
preparationsforthescienceprogram.

MPLRecommendation:
EnsurethatadetailedLanderscienceplan,tools,andnecessarysupportareinplace
beforethelanding.TheProjectScientistshouldbefullyinvolvedinthemanagementof
thescienceoperationsplanningandimplementation.

34

8.PhaseIIPlan
DuringthePhaseIIactivity,theBoardwillreviewandevaluatetheprocessesusedbythe
MCOandMPLmissionsandotherpastmissionsuccessesandfailures,developlessons
learned,makerecommendationsforfuturemissions,anddeliverareportnolaterthan
February1,2000.Thisreportwillcoverthefollowingtopicsandanyotheritemsthe
Boardfeelsrelevantaspartoftheinvestigationprocess.
1. Processestodetect,articulate,interpretandcorrecterrorstoensuremission
safetyandreliability
2. Systemsengineeringissues,including,butnotlimitedto:
Processestoidentifyprimarymissionsuccesscriteriaasweightedagainst
potentialmissionrisks
Operationalprocessesfordatavalidation
Managementstructureandprocessestoenableerrorfreecommunications
andproceduredocumentation
Processestoensurethatestablishedprocedureswerefollowed
3. Testing,simulationandverificationofmissionsoperations
4. WorkForceDevelopment
5. Workforceculture:confidenceorconcern?
6. Independentassessments
7. PlanetaryNavigationStrategies:GroundandAutonomous
Accuracy&Precisionthatcanbedelivered
Current&futuretechnologiestosupportMarsmissions
Navigationrequirementsandpreflightdocumentation
DuringthePhaseIIinvestigationprocess,theBoardwillobtainandanalyzewhatever
evidence,facts,andopinionsitconsidersrelevant.Itwillusereportsofstudies,findings,
recommendations,andotheractionsbyNASAofficialsandcontractors.TheBoardmay
conductinquiries,hearings,tests,andotheractionsitdeemsappropriate.Theywill
developrecommendationsforpreventiveandotherappropriateactions.Findingsmay
warrantoneormorerecommendations,ortheymaystandalone.Therequirementsinthe
NASAPolicyDocument(NPD)8621.1GandNASAProceduresandGuidelines(NPG)
8621.1(draft)willbefollowedforprocedures,format,andtheapprovalprocess.

35

Appendix

LetterEstablishingtheMarsClimateOrbiterMishap
InvestigationBoard

36

SD
TO:

Distribution

FROM:

S/Associate Administrator for Space Science

SUBJECT:

Establishment of the Mars Climate Orbiter (MCO) Mission

Failure Mishap Investigation Board

1.

INTRODUCTION/BACKGROUND
The MCO spacecraft, designed to study the weather and climate of
Mars, was launched by a Delta rocket on December 11, 1998, from
Cape Canaveral Air Station, Florida. After cruise to Mars of
approximately 9 1/2 months, the spacecraft fired its main engine
to go into orbit around Mars at around 2 a.m. PDT on September
23, 1999.
Five minutes into the planned 16-minute burn, the spacecraft
passed behind the planet as seen from Earth. Signal
reacquisition, nominally expected at approximately 2:26 a.m. PDT
when the spacecraft was to reemerge from behind Mars, did not
occur. Fearing that a safehold condition may have been triggered
on the spacecraft, flight controllers at NASAs Jet Propulsion
Laboratory (JPL) in Pasadena, California, and at Lockheed Martin
Astronautics See figure 1. The spacecraft was to then skim
through Mars' upper atmosphere for several weeks in a
Efforts to find and communicate with MCO continued up until 3
p.m. PDT on September 24, 1999, when they were abandoned. A
contingency was declared by MCO Program Executive,
Mr. Steve Brody at 3 p.m. EDT on September 24, 1999.

2.

PURPOSE
This establishes the NASA MCO Mission Failure Mishap Investigation
Board and sets forth its terms of reference, responsibilities, and
membership in accordance with NASA Policy Directive (NPD) 8621.1G.

3.

ESTABLISHMENT
a. The MCO Mission Failure Mishap Investigation Board
(hereinafter called the Board) is hereby established in the
publics interest to gather information, analyze, and determine
the facts, as well as the actual or probable cause(s) of the MCO
Mission Failure Mishap in terms of (1) dominant root cause(s),
(2) contributing cause(s), and (3) significant observations and
to recommend preventive measures and other appropriate actions to
preclude recurrence of a similar mishap.
b. The chairperson of the board will report to the NASA Office
of Space Science (OSS) Associate Administrator (AA) who is the
appointing official.

4.

OBJECTIVES

A.

An immediate priority for NASA is the safe landing on December

3, 1999, of the Mars Polar Lander (MPL) spacecraft, currently en
route to Mars. This investigation will be conducted recognizing

37

the time-criticality of the MPL landing and the activities the

MPL mission team must perform to successfully land the MPL
spacecraft on Mars. Hence, the Board must focus first on any
lessons learned of the MCO mission failure in order to help
assure MPLs safe landing on Mars. The Board must deliver this
report no later than November 5, 1999.
i. The Board will recommend tests, analyses, and
simulations capable of being conducted in the near term
to prevent possible MPL failures and enable timely
corrective actions.
ii. The Board will review the MPL contingency plans
and recommend improvements where possible.
B.

The Board will review and evaluate all the processes used by the
MCO mission, develop lessons learned, make recommendations for
future missions, and deliver a final mishap investigation report no
later than February 1, 2000. This report will cover the following
topics and any other items the Board thinks relevant.
i. Processes used to ensure mission safety and reliability
with mission success as the primary objective. This will include
those processes that do not just react to hard failures, but
identify potential failures throughout the life of the mission
for which corrective actions can be taken. It will also include
asking if NASA has the correct philosophy for mission assurance
in its space missions. That is:

a) "Why should it fly?" versus "why it should not fly?,

b) mission safety should not be compromised by cost
and performance, and

c) definition of adequacy, robustness, and margins-of-safety

as applied to clearly defined mission success criteria.

ii.
to:

Systems engineering issues, including, but not limited

a) Processes to identify primary mission success criteria

as weighted against potential mission risks,
b) operational processes for data validation,
c) Management structure and processes to enable errorfree communications and procedure documentation, and
d) processes to ensure that established procedures
were followed.
iii. Testing, simulation and verification of
missions operations:
a) What is the appropriate philosophy for conducting endto-end simulations prior to flight?
b) How much time and resources are appropriate for
program planning?
c) What tools should be developed and used routinely?
d) How should operational and failure mode identification
teams be formed and managed (teams that postulate
failure modes and inspire in-depth review)?
e) What are the success criteria for the mission, and what is
required for operational team readiness prior to the
Flight Readiness Review (i.e., test system tolerance to
human and machine failure)?, and
f) What is the recommended developmental process to ensure
the operations team runs as many failure modes as possible
prior to launch?

38

iv. Personnel training provided to the MCO operations

team, and assess its adequacy for conducting operations.
v. Suggest specific recommendations to prevent basic
types of human and machine error that may have led to the
MCO failure.
vi. Reexamine the current approach to planetary
navigation. Specifically, are we asking for more accuracy
and precision than we can deliver?
vii. How in-flight accumulated knowledge was captured
and utilized for future operational maneuvers.
5.

AUTHORITIES AND RESPONSIBILITIES

a.

The Board will:

1) Obtain and analyze whatever evidence, facts, and
opinions it considers relevant. It will use reports of
studies, findings, recommendations, and other actions by
NASA officials and contractors. The Board may conduct
inquiries, hearings, tests, and other actions it deems
appropriate. It may take testimony and receive statements
from witnesses.
2) Determine the actual or probable cause(s) of the MCO
mission failure, and document and prioritize their findings
in terms of (a) the dominant root cause(s) of the mishap,

(b) contributing cause(s), and (c) significant

observation(s). Pertinent observations may also be made.
3) Develop recommendations for preventive and other
appropriate actions. A finding may warrant one or more
recommendations, or it may stand-alone.
4) Provide to the appointing authority, (a) periodic
interim reports as requested by said authority, (b) a
report by

November 5, 1999, of those findings and recommendations and

lessons learned necessary for consideration in preparation
for the MPL landing, and (c) a final written report by
February 1, 2000. The requirements in the NPD 8621.1G and
NASA Procedures and Guidelines (NPG) 8621.1 (draft) will be
followed for procedures, format, and the approval process.

b.

The Chairperson will:

1) Conduct Board activities in accordance with
the provisions of
NPD 8621.1G and NPG 8621.1 (draft) and any other
instructions that the appointing authority may issue
or invoke.
2)
the
any
and

Establish and document rules and procedures for

organization and operation of the Board, including
subgroups, and for the format and content of oral
written reports to and by the Board.

3) Designate any representatives, consultants, experts,

liaison officers, or other individuals who may be required
to support the activities of the Board and define the
duties and responsibi-lities of those persons.

39

6.

MEMBERSHIP
The chairperson, other members of the Board, and supporting
staff are designated in the Attachment.

7.

MEETINGS
The chairperson will arrange for meetings and for such records
or minutes of meetings as considered necessary.

8.

ADMINISTRATIVE AND OTHER SUPPORT

a. JPL will provide for office space and other facilities and
services that may be requested by the chairperson or designee.

b. All elements of NASA will cooperate fully with the Board

and provide any records, data, and other administrative or
technical support and services that may be requested.
9.

DURATION
The NASA OSS AA, as the appointing official, will dismiss
the Board when it has fulfilled its responsibilities.

10.

CANCELLATION
This appointment letter is automatically cancelled 1 year from
its date of issuance, unless otherwise specifically extended by
the approving official.

Edward J. Weiler
Enclosure

Distribution:
S/Dr. E. Huckins
S/Dr. C. Pilcher
SD/Mr. K. Ledbetter
SD/Ms. L. LaPiana
SD/Mr. S. Brody
SR/Mr. J. Boyce
SPR/Mr. R. Maizel
SPR/Mr. J. Lee
Q/Mr. F. Gregory
QS/Mr. J. Lloyd
JPL/180-904/Dr. E. Stone
JPL/180-704/Dr. C. Elachi
JPL/180-703/Mr. T. Gavin
JPL/230-235/Mr. R. Cook
JPL/264-426/Mr. C. Jones
JPL/180-904/Mr. L. Dumas
MCO FIB Board Members, Advisors, Observers, and Consultants.

40

ATTACHMENT
Mars Climate Orbiter (MCO) Failure Investigation Board (FIB)
Members
MSFC/Mr. Arthur G. Stephenson Chairperson

HQ/Ms. Lia S. LaPiana

Director,
George C. Marshall Space
Flight Center

Executive Secretary

HQ/Dr. Daniel R. Mulville

HQ/Dr. Peter J. Rutledge
(ex-officio)

GSFC/Mr. Frank H. Bauer

GSFC/Mr. David Folta

MSFC/Mr. Greg A. Dukeman

MSFC/Mr. Robert Sackheim

ARC/Dr. Peter Norvig

Advisors: (non-voting participants)

Legal Counsel:

Office of Public Affairs:

Consultants:
Ms. Ann Merwarth

NASA/GSFC-retired

Expert in ground operations and flight

software development

41

Dr. Moshe F. Rubinstein, Prof. Emeritus,

UCLA, Civil and Environmental
Engineering
Mr. John Mari

Vice-President of Product Assurance

Mr. Peter Sharer

Senior Professional Staff

Mr. Craig Staresinich

Program management and Operations Expert

Lockheed Martin Aeronautics

Mission Concepts and Analysis Group

The Johns Hopkins University
Applied Physics Laboratory

TRW
Dr. Michael G. Hauser

Deputy Director

Space Telescope Science Institute

Mr. Tim Crumbley

Deputy Group Lead

Flight Software Group

Avionics Department
George C. Marshall Space Flight Center
Mr. Don Pearson

Assistant for Advanced Mission Design

Flight Design and Dynamics Division

Mission Operations
Directorate
Johnson Space Center

42

Observers:
JPL/Mr. John Casani

(retired) Chair of the JPL MCO special review board

JPL/Mr. Frank Jordan

Chair of the JPL MCO independent peer

review team
JPL/Mr. John McNamee

Chair of Risk Assessment Review for MPL

Project Manager for MCO and MPL

(development through launch)
HQ/SD/Mr. Steven Brody
(ex-officio)

MCO Program Executive

NASA Headquarters

MSFC/DA01/Mr. Drew Smith

Special Assistant to Center Director

HQ/SR/Dr. Charles Holmes

Program Executive for Science

George C. Marshall Space Flight

Center

Operations
NASA Headquarters
HQ/QE/Mr. Michael Card
(ex-officio)

Program Manager
NASA Headquarters

43

Acronymlist
AA=AssociateAdministrator
AACS=ArticulationandAttitudeControlSystem
AMD=AngularMomentumDesaturationEDL=
Entry,Descent,Landing
GDS=GroundDataSystem
ICD=InterfaceControlDocument
ISA=Incident,Surprise,Anomaly
JPL=JetPropulsionLaboratory
lbfs=pounds(force)second
LESF=LanderEntryStateFile
LIDAR=LightDetectionandRanging
LMA=LockheedMartinAstronautics
MCO=MarsClimateOrbiter
MGS=MarsGlobalSurveyor
MIB=MishapInvestigationBoard
MOI=MarsOrbitalInsertion
MOS=MissionOperationsSystem
MPL=MarsPolarLander
MSOP=MarsSurveyorOperationsProject
MSP=MarsSurveyorProgram
MSP98=MarsSurveyorProject98
NASA=NationalAeronauticsandSpace
AdministrationNPD=NASAPolicyDirective
NPG=NASAProceduresandGuidelines
Ns=Newtonseconds
NST=NearSimultaneousTracking
OSS=OfficeofSpaceScience
PDT=PacificDaylightTime
SCAM=StarCameraAttitudeManeuver
SIS=SystemInterfaceSpecifications
TCM=TrajectoryCorrectionManeuver
UTC=UniversalTimeCoordinated
V&V=VerificationandValidation
V=VelocityChange

44