Contents
At 9:04 a.m. UTC on September 23, 1999, the radio signal cuts out. The Mars Climate Orbiter has just fired its main engine to swing into orbit around Mars. The plan called for a closest approach at an altitude of 226 kilometers. Later reconstruction puts it at about 57 kilometers. The minimum considered survivable was 80. The signal never returns. An example of the Team Principle of the Weakest Link.
A File Between Two Teams
Situation
The spacecraft launches on December 11, 1998. Lockheed Martin built it; the Jet Propulsion Laboratory (JPL) handles navigation. The probe carries a single solar array on one side. As a result, solar radiation pressure twists it more than it did its predecessor, and small thruster firings are needed to correct it ten to fourteen times more often than expected. Each firing alters the trajectory slightly. Ground software from Lockheed Martin calculates the impulse and writes it to a file for the navigators. The interface agreement calls for newton-seconds. The software delivers pound-force seconds. JPL’s navigation software reads the numbers as metric. The error is a factor of 4.45, and it accumulates over nine months of flight.
Connection to the team principle
The Team Principle of the Weakest Link says: where everyone depends on everyone else, the weakest member determines the outcome. In 1993 the economist Michael Kremer described a model for situations like this: when a project requires many steps and a mistake in any single step destroys the value of the whole, the quality of the steps does not add up – it multiplies. This is a theoretical model, not a measurement, but it describes this case precisely. Engines, radio, orbital mechanics and attitude control all worked. One number in the wrong unit at one handover was enough.
Doubts That Stayed in the Inbox
Situation
During the flight the navigators notice discrepancies. They discuss them informally by email rather than through the formal reporting procedure intended for exactly this. The operations navigation team is separate from the development team. It has not taken part in the design reviews and is unaware of some of the spacecraft’s peculiarities. During the approach phase, a single navigator is looking after the probe and a second mission at the same time.
Connection to the team principle
A weak point only becomes fatal when the safeguards behind it are weak too. Here there were three: a reporting channel that went unused, a team that did not know the background, and staffing that left no time for doubts. It would therefore be wrong to tell this story as the error of a single programmer. The weakest point lay between people, not in any one of them.
The Final Correction That Never Came
Situation
Shortly before orbit insertion, the calculations no longer point to 226 kilometers but to somewhere between 110 and 170. A fifth trajectory correction maneuver could have raised the path. It has not been prepared and is not carried out. On September 23 the insertion maneuver begins, and the spacecraft is lost.
Connection to the team principle
If you know your chain may have a thin spot, you build in a buffer. The fifth maneuver would have been such a buffer. The fact that it was not ready shows that the team did not expect an error at this point. The principle does not demand that you eliminate every weakness. It demands a reserve wherever a single error costs everything.
What the Board Found
Situation
On November 10, 1999, the investigation board led by Arthur G. Stephenson presents its first report. It names the wrong unit in a piece of ground software as the root cause. On top of that come eight contributing causes, among them poor communication between parts of the project, understaffing, inadequate training and a software review that did not cover the ground software.
Connection to the team principle
One root cause, eight contributing causes: the report describes not a single glitch but a chain whose checkpoints gave way one after another. What is striking is what was checked and what was not. The software on board the spacecraft was checked. The software on the ground, which merely wrote a file, slipped through the cracks. The weakest link is often the one nobody considers important enough to check.
Key takeaways
Key Lessons
- Don’t look for the weakest link only among people. Check the handovers: who delivers what to whom, in what form, in what unit?
- Don’t just write down agreements at interfaces – test whether they are actually being kept.
- Give doubts a binding channel. Anything raised only in a hallway conversation or by email has no recipient who is obliged to act.
- Keep a way to correct course ready wherever a single error would cost the entire project.
- Watch who is solely responsible in the critical phase and how much else they are carrying at the same time.
Summary
The Mars Climate Orbiter was lost because two programs used different units at a handover and nobody formally reported the problem in time. Besides this root cause, the investigation found eight further weaknesses in communication, staffing, training and review. Here the Team Principle of the Weakest Link becomes visible through failure: many good parts do not make a good whole if one connection fails. That is why anyone who leads checks the seams as thoroughly as the parts.