Revenge of the Great Galactic Ghoul
If 1997 had been a great year for JPL, 1999 would be a banner year for JPL’s bane, the Great Galactic Ghoul—and an annus horribilis for NASA, in the view of The Economist.1 In September and December, the Ghoul would dine happily on the Mars Climate Orbiter, Polar Lander, and the Deep Space 2 microprobes. Their loss would effectively end the Mars Surveyor program and its two-launches-per-launch-period edict. The 2003/2005 Mars sample return project would die too.
It was not obvious that the Surveyor 1998 project’s outcome would be so terrible. The initial difficulties Climate Orbiter and Polar Lander experienced right after launch were not severe; in fact, they were less traumatic than the post-launch problems experienced by both Mars Global Surveyor and Pathfinder. Donna Shirley, former JPL Mars exploration director, followed Associate Administrator Wes Huntress into retirement late in 1998, frustrated with the Mars Exploration Directorate’s problems with NASA headquarters but thinking that project manager John McNamee’s two Surveyor 1998 missions were going to succeed. Years later, she would recollect going to see David Baltimore, Caltech’s president, and telling him that George Pace’s Surveyor 2001 missions would probably fail, not the 1998 missions.2 The losses were shocking to the project team, and to JPL.
Site Selection for Mars Polar Lander
Polar Lander had been sent off to Mars without a final decision about where it was to land. With Mars Pathfinder, Matt Golombek had done the site selection long before launch, giving the project’s engineers the opportunity to design the vehicle for its likely landing zone. Polar Lander’s principal investigator, Dave Paige, and his former mentor at JPL, Richard Zurek, though, had wanted to wait for the high-resolution imagery and altitude data that Mars Global Surveyor would return before making their final choice. The Viking datasets from a generation ago gave little information about the south polar region, and no direct measurement of altitudes. So the laser altimeter on Global Surveyor would provide valuable new information. Assuming that Global Surveyor would get into its Mars orbit without too much trouble, Paige and Zurek had decided to wait until that data became available partway through Polar Lander’s flight. So Polar Lander was launched generally toward the martian south pole region, and its navigation plan included a site selection maneuver that would enable targeting a specific site once it was chosen.
Paige’s hope in proposing the mission had been to land poleward of 60° south latitude, within what showed in the Viking imagery as intricately layered terrain. As the mission design effort had progressed during 1995 and 1996, the lander engineers gradually had been convinced that higher latitudes actually would be an easier design problem. This was because the closer to the pole the lander went, the longer the weak martian daylight would last. Both the power and thermal environments became more manageable. So during the design phase, the target latitude moved southward, reaching 75° south by early 1997.3 Using the Viking orbiter imagery from the late 1970s, the project scientists had looked for interesting sites within the polar layered terrain and that appeared to be within the lander’s capabilities. They developed a set of ten candidates and asked Mike Malin to image the region with his Mars orbiter camera on Global Surveyor once it was in a suitable orbit.
In January 1998, the project science team had met to look at the first images Malin’s camera had obtained. These convinced the Polar Lander team that they didn’t yet have enough information to make a site selection choice. So they had the mission designer plan the initial trajectory to Mars so that it would target the general region they wanted and could be adjusted to a specific site sometime after the second trajectory correction maneuver (TCM) in March 1999. At the end of June 1999, the science team held a landing site workshop to shrink the list of potential sites to four. Global Surveyor’s laser altimeter had gotten five “stripes” of data across the desired landing ellipse. Rich Zurek remembers that these data disabused the group of a naive belief that the south polar layered terrain would be relatively flat, with little topography. Instead, “there was lots of variation,” including a kilometer-deep hole inside their landing ellipse but near its edge.4 Their landing ellipse was about 250 km long and 20 km at its maximum width, far too large an area for the Mars orbiter camera to photograph at its highest resolution. Instead, they imaged a handful of sites and assumed the rest of the region was similar. After some discussion, the group chose a primary landing site centered at 76° south, 195° west, and a backup site at 75° south, 180° west. NASA headquarters approved of the choices after a review on August 24. On September 1, 1999, the Surveyor Operations Project team carried out the lander’s site adjustment maneuver to target the primary landing site.5
Flights to Mars
About a year before the launches of Climate Orbiter and Polar Lander, Sam Thurman had started to transition over to the Mars Surveyor Operations Project, which would operate the two vehicles after launch. Engineer Pete Theisinger was responsible for developing and deploying the ground systems necessary to operate the two spacecraft. Theisinger had a budget of about $5 million from the Surveyor 1998 project to do this; it had not been enough, and about $2 million more from the Mars Global Surveyor project’s underrun had also been allocated to complete the operations system.6
The Surveyor Operations Project had maintained the same basic operations structure for John McNamee’s two spacecraft as it had built for Global Surveyor. Out in Denver, Lockheed Martin engineers monitored the spacecraft engineering data and were responsible for building and testing the command sequences that told the vehicles what to do. JPL maintained the navigation and tracking functions. A daily phone conference served to keep all the parts of the operations effort working in concert, and the JPL and Lockheed segments exchanged in-progress command sequences electronically.
The one substantial difference for the 1998 missions was the Polar Lander’s surface operations, which were to be run from the University of California, Los Angeles, where Dave Paige intended to gather the project’s other scientists and a considerable student workforce. UCLA’s mission operations facility was not set up until after launch, and would not be ready until July, when the first entry, descent, and landing (EDL) and surface operations tests would be held. One significant personnel change happened, too. Glenn Cunningham retired as manager of the Surveyor Operations Project in mid-June 1999, and Richard Cook, who had been the mission operations manager for Mars Pathfinder, replaced him.
The Surveyor Operations Project’s place within JPL’s hierarchy had changed, too. After Donna Shirley retired late in 1998, Mars Exploration Directorate chief Norm Haynes had also announced his intention to retire, so JPL director Ed Stone had decided to merge the Mars Exploration Directorate with Charles Elachi’s Space and Earth Science Programs Directorate (SESPD). Cook, as head of the Surveyor Operations Project, now reported to Elachi, not to the Mars Exploration Directorate, which became responsible only for future project planning. George Pace no longer reported to the Mars office either but instead reported to Tom Gavin, head of Elachi’s Planetary Flight Projects Office.7 The Mars sample return project was its own organizational entity, separate from the Mars office, the Surveyor Operations Project, and the Planetary Flight Projects Office. In its early 1999 configuration, Elachi’s SESPD had 15 offices, responsible for seven different programs, reporting to him. Pace felt buried under the new organization. He remarked later that the reorganization had “negated any synergy that the Mars projects had benefited from by at least having a common manager.”8
Organization chart for the Space and Earth Science Programs Directorate from the Mars Program Independent Assessment Team report. Note that the Mars flight projects, highlighted in gray, no longer reported to the Mars Surveyor Program Office, and the Mars Surveyor Program Office no longer reported to the JPL director. From Mars Program Independent Assessment Team report, 14 March 2000, MPIAT_report_2000.pdf, Historian’s Mars Exploration Collection, JPL, p. 51.
Shortly after launch, the Surveyor Operations Project staff was surprised by the orbiter’s behavior. Like most spacecraft built after the mid-1970s, Climate Orbiter used reaction wheels as part of its attitude control system. The wheels were really just gyroscopes aligned along the vehicle’s three axes, and, like a child’s top spinning, they could absorb a certain amount of torque (a “push” that causes rotation) before they would saturate. When that happened, engineers on the ground had to use the spacecraft’s thrusters to remove the stored energy. Mars Global Surveyor had required these “desaturation burns,” as they are known, once a week. But Climate Orbiter needed them twice per day—a substantial workload for the small team, and one that few of the operators had expected. This was not a flaw in the vehicle, however; it was actually operating exactly as Lockheed’s engineers had intended it to.
Global Surveyor had been slowly spinning around its Sun axis during cruise to save a little fuel and in that operational mode had not needed to carry out these firings very often. But Lockheed’s engineers had decided to fly Climate Orbiter in its three-axis stabilized mode, and without the slow spin, it needed more frequent firings. Solar pressure on the large, off-center single solar array was what caused the need for the firings. The array’s location to one side of the vehicle caused it to try to “spin” the spacecraft around its north-south aligned axis (also known as its z-axis), and one of the three reaction wheels was constantly resisting this torque. This Sun-induced torque was causing that one reaction wheel to saturate every half-day or so, necessitating the frequent desaturation burns.
The flight team at JPL was surprised by this behavior due to a miscommunication. The original navigation plan for the orbiter had been based on a Global Surveyor–like spin mode, but after the decision to switch the cruise to three-axis stabilized mode, it had not been revised. So while Thurman had expected Climate Orbiter to be doing these frequent desaturation burns, the majority of the flight team had not.
The orbiter’s first trajectory correction maneuver (TCM-1) had gone off without a hitch on December 21. The second, initially scheduled for January 25, 1999, was delayed after the Polar Lander’s post-launch difficulties began to consume the operations project’s limited manpower. The orbiter’s TCM-2 was rescheduled to March 4, to give the project team the time to troubleshoot and correct Polar Lander’s star camera problem—the cameras were unable to find their reference stars (see chapter 6)—while also keeping their commitment to provide ground operations for Stardust, another simultaneous JPL mission, after its launch in February.9 A week after TCM-2, Thurman’s operators got the orbiter’s new attitude control profile uploaded, permanently correcting for the thermal problems with the main thruster. On March 15, they performed the lander’s second TCM, again without troubles.10 By mid-April, they had resolved their remaining known problems by software updates, including an odd problem that the attitude control thruster data being sent back by the spacecraft was arriving at JPL in an incorrect format. Once the data became readable, Climate Orbiter’s navigator began to realize that the thruster data did not match the Doppler tracking data from the Deep Space Network. On April 14, the navigator visited Lockheed’s Denver-based spacecraft team, and on April 26, he e-mailed to ask them to look into the discrepancy between the thruster and Doppler data sets. During May, Lockheed’s attitude control group began to work on the problem but didn’t resolve it before a reorganization replaced the group leader in early June.11
The Mars Pathfinder team had spent a large part of their flight to Mars running EDL simulations on their testbed in between operational readiness tests (ORTs) in order to uncover previously undiscovered errors. The Surveyor Operations Project had not had money to do this for Polar Lander at first. But McNamee was able to convince officials at NASA headquarters to provide about $4 million to pay for this “stress testing,” as he called it. The testing started in late May and ran through the end of August. Once Polar Lander’s surface operation center at UCLA was functioning, staff there also began rehearsing the first few days of lander surface operations.
On July 23, the operations team sent Climate Orbiter the command sequence for its third TCM. The vehicle carried it out on the morning of the 25th. But afterward, the spacecraft reported a problem in the solar array’s gimbal mechanism, which allowed the array to track the Sun. During the maneuver, the spacecraft automatically put the array into the mechanical restraint to protect the drive mechanism. Apparently after the thruster firing, as the spacecraft moved the array back out of the restraint, the sensor reporting the array’s position had malfunctioned. Fault protection software switched to a backup sensor and completed repositioning the array.
The apparent fault caused great concern on the project, despite the lack of immediate consequences. The array had to be moved in and out of the restraint for the remaining TCMs, for the orbit insert burn, and for every aerobraking pass. But it wasn’t clear from the telemetry whether the sensor was at fault, the gimbal was malfunctioning, or whether anything was wrong at all. A failure of one of the two sensors was tolerable, though hardly desirable. But the gimbal mechanism was mission critical. If it were failing, the mission would be over shortly. The gimbal had no backup. It had to be proven to be working correctly. For the next few weeks, Lockheed orbiter manager Steve Jolly assigned his Denver-based team to work on this issue—to identify diagnostic tests that could be performed on the spacecraft to check the gimbal’s operation, to carry them out, and to understand the results of those tests.12 This all had to be done in time for TCM-4, which was scheduled for September 15.
After this maneuver, the Surveyor Operations Project was confronted with another challenge. The navigation solutions for the vehicle were diverging. JPL navigators used three methods to estimate a spacecraft’s probable location. Normally these methods produced position solutions that were in close proximity to each other, and as more tracking data came in after a TCM, the solutions would converge. But for Climate Orbiter the solutions remained dozens of kilometers apart.13 Something seemed to be wrong with the data, and the orbiter’s navigator—Climate Orbiter had only one full-time navigator with a couple of part-time assistants—started to be concerned about it.
The worst-case solution, the one putting the spacecraft closest to Mars at orbit insert, was at about 110 km altitude, and the lead navigator raised the issue with the project in early August. He was concerned both with the apparently low projected periapsis for the first orbit and with the magnitude of the divergence in the solutions. These seemed to him to indicate a significant problem with either the spacecraft or the way it was being operated.
A series of meetings between the lead navigator, Sam Thurman, Richard Cook, and other members of the Surveyor Operations Project later in the month did not resolve the issue. The navigation team came away frustrated at not having gained a higher priority for their investigation of the trouble, but they thought they had an agreement to use the final TCM in the schedule, which was formally a “contingency” maneuver, to raise the projected orbit. The project management came out of the meetings thinking that while they might well find themselves in a lower initial orbit than they sought, even the worst-case solutions the navigators presented were still within the spacecraft’s thermal and structural capabilities. So the problematic solar array remained their highest priority.
By early September, Steve Jolly’s team in Denver thought they understood the solar array incident and had prepared command sequences to test it. These were transmitted to Climate Orbiter on September 2. The next day, the tests showed that the array was hitting the spacecraft during the unstowing procedure, so they had to alter the software that controlled the array’s movements. Jolly put his spare people on the array problem again, as it was still the biggest risk to the mission. Over that weekend, they reworked the software and tested it in the spacecraft test lab. On September 8, they ran the new sequence on Climate Orbiter, fixing the problem.14
But the navigation problem returned after the fourth TCM on September 15. The “quick look” navigation solutions put the projected periapsis about at 138 km, instead of the 210 km the maneuver had been designed for.15 The lower periapsis altitude was tolerable but not desirable; given that the navigation solutions had shown a consistently large spread, it left a possibility that the spacecraft’s second orbit after insertion would be dangerously close to the planet. The project’s risk management plan specified a minimum 150 km altitude, so Thurman and Jolly had built and tested a command sequence that would use a contingency TCM-5, scheduled for September 20, to raise the orbit about 44 km. The sequence was tested in Denver satisfactorily on September 17.
On the next morning, John McNamee called a meeting of the Mars Surveyor Operations Standing Review Board at JPL to review the desirability of carrying out TCM-5. Three of the eight members were able to attend; he didn’t invite the project’s navigator. At the meeting, Thurman argued that the current periapsis estimates of 150–170 km did not warrant carrying out the final TCM. The sequence that commanded the orbit insertion burn was already running aboard the spacecraft, and he was concerned that the TCM sequence would interfere with the orbit insertion sequence. The two sequences had been run together in the simulator, but one could never be certain that the simulator was a perfect representation of the spacecraft. He was also concerned that the project had never practiced TCM-5 via an operational readiness test, so the flight team was not well prepared for it and whatever might go wrong during it.
After some discussion, the board members present agreed with the decision not to carry out TCM-5, with the caveat that if the orbit solutions generated that afternoon grew worse, the decision would be revisited. Those solutions stayed within the 150–170 km range, and on the September 19, at the go/no-go decision meeting, they agreed that the trajectory correction maneuver would not be carried out.16
Orbit insertions are generally big events at JPL, and Climate Orbiter’s was no different. Because the orbit insertion would take place a little after 2:00 a.m. Pacific time, mission scientists had explained their goals to assembled reporters at a press conference in the Lab’s Von Karman Auditorium the previous morning. Cameras started providing a live video feed from the mission support area and from Lockheed Martin’s similar facility in Denver at 1:30 a.m. Climate Orbiter’s orbit insertion events started with a final desaturation burn of the maneuvering thrusters, followed by a final telemetry downlink. At 16 minutes prior to start of the main engine firing, telemetry shut down, leaving only the carrier signal broadcasting via its medium-gain antenna. The burn was expected to last about 16 minutes—the engine would fire until it ran out of oxidizer, so the timing could vary by a few seconds. Five and a half minutes after the burn started, the spacecraft should disappear behind Mars, its radio signal blocked by the planet itself. About 27 minutes later, it should reappear, having finished the burn, redeployed the solar array, and activated the high-gain antenna.17
The navigation solutions available to the flight team the night before projected the orbit periapsis at 150 km, lower than they’d wanted but well within the spacecraft’s capabilities. But two hours before the insertion burn, a new solution put the periapsis at 110 km. While acceptable for the first orbit, it would result in the second orbit passing dangerously low in the atmosphere, so the team started preparing a command sequence to raise the orbit periapsis immediately after the insertion burn.18 But they were concerned that they might not have enough time to get the command uplinked before Climate Orbiter disappeared behind Mars again on its second orbit the next day. This was their chief worry.
All of the preprogrammed events of the orbit insert went nearly perfectly prior to occultation. The Deep Space Network picked up the Doppler shift in the carrier signal precisely when the engine should have started firing, proving that everything to that point had gone well. The next event, occultation by Mars, was the first indication that not all was well. They lost the signal 39 seconds early. No one in JPL’s mission support area noticed it at the time, though. The Mars atmosphere determined when the last moment of signal reception would be, and its high variability made this prediction uncertain. Interviewed a few minutes later, the mission manager told the television audience that everything was “nominal.”19
Climate Orbiter never emerged from occultation. Ten minutes or so after the predicted time of emergence, Lockheed’s mission operators started working through their preplannned loss of signal procedure, which was based on the premise that the spacecraft had gone into its safe mode. In this mode the vehicle would maneuver automatically to align the solar array with the Sun and then listen for commands from Earth. The flight team sent up a command to turn on the low- and medium-gain antennae, which the Deep Space Network could detect through a large range of possible spacecraft orientations. But they still heard nothing.
After 30 minutes without a signal, Cook also had other recovery procedures started. This included a review of all the navigation data from the last 24 hours. That provided the first tentative answer. As the spacecraft had neared Mars, the planet’s gravity and the presence of Mars Global Surveyor within the Deep Space Network’s field of view permitted a much more accurate trajectory determination. And a shocking change in the solutions appeared. The vehicle seemed to be about 100 km closer to Mars than predictions made the day before.
By 8:00 a.m. Pasadena time, the Surveyor Operations Project knew what had happened, though not yet why. Instead of entering an orbit with a 110 km altitude periapsis, the craft had entered an orbit with a 60 km periapsis. Lockheed’s analysis showed that at about 98 km altitude, the orbiter would have exceeded its thermal limits; at 85 km altitude, the attitude control system would no longer have been able to counter aerodynamic forces imposed by the atmosphere.20 At right around 60 km altitude, the spacecraft’s solar array would probably have been torn off.
Richard Cook, John McNamee, and Carl Pilcher, NASA’s solar system exploration director, answered questions from the press that morning. Cook did most of the talking, explaining in his opening statement that they appeared to have had a serious navigation error and that the spacecraft had probably entered the martian atmosphere and been destroyed. The more experienced reporters in the room were in disbelief; it was the first time JPL had ever lost a spacecraft due to a navigation error. Cook told them he was as shocked as they were—a 100 km error was so far outside anyone’s experience that it simply hadn’t been conceivable.21 Typical navigation errors were 2 to 3 km.
The team continued trying to contact Climate Orbiter for the next day or so, sending up various commands relating to transmitters, orientation, and finally, in Steve Jolly’s words, made a “last-ditch attempt to uplink and execute a large periapsis-raise maneuver” before the second orbit. Uncorrected, this second orbit would have had a periapsis of only 40 km, “a passage in which the spacecraft would enter and surely not survive.”22 But they had little hope. McNamee understood they’d lost the vehicle as soon as the navigation error had been revealed, but due diligence required that they try to reach it until it passed behind Mars again. No one believed it would survive that second orbit.
That evening, Ed Stone sent out an all-hands e-mail message announcing the probable loss of the orbiter.23 On the September 24, Steve Jolly sent an e-mail to all of the mission personnel explaining in detail the efforts to revive the spacecraft and concluding, “The Flight Team personnel at both LMA and JPL would like to express our deepest regret and disappointment in the loss of MCO. This goes out to all of the Flight Systems and JPL personnel that have dedicated so much to see that this mission was successful.”24
On September 29, Sam Thurman sent out the formal end of mission report.25
Navigating the Investigations
Sometime during the early morning between the orbiter’s disappearance and the 8:00 a.m. press conference, John McNamee had called Tom Gavin to tell him he thought they’d flown Climate Orbiter into Mars. Gavin had recently been the Cassini spacecraft manager and had just become deputy to SESPD director Charles Elachi at JPL. Gavin, an electronics engineer by training, called Frank Jordan, who had recently joined the Mars program office after a long career in Lab’s navigation section, and told him to show up at the press conference. Sitting near the back in Von Karman, Jordan heard Richard Cook admit to the 100 km navigation error in disbelief, and then tears. The next day, Jordan was formally appointed chairman of the Mars Climate Orbiter Navigation Peer Review committee, one of three investigations started after the loss.26
It did not take very long to figure out what had happened. The large divergence in the navigation solutions in the weeks prior to the orbit insert strongly suggested to Jordan that some sort of modeling error was involved. There were only two things that the Deep Space Network could measure very accurately: the range to a spacecraft and the Doppler shift imposed on its radio signal by accelerations. These allow determination of the spacecraft’s distance from Earth much more accurately than they do its angular position in the sky (what navigators call its plane-of-sky location). To produce more accurate estimates of a spacecraft’s angular position, navigators have to estimate the magnitudes of many other forces on a spacecraft, including solar pressure, the gravitational accelerations imposed by the other planets, and the effects of the accelerations imposed by the spacecraft’s own activities. Because JPL operated many other spacecraft, the solar pressure and gravitational models used on the orbiter could be checked by applying them to another spacecraft and seeing if they produced that vehicle’s known location. They did. So something was wrong with the modeling of the spacecraft’s self-imposed accelerations.
There were only a couple of possibilities for error in those calculations. If the spacecraft had sprung a leak in one of its pressurized tanks, it would have produced a large, unmodeled acceleration. But it would also have showed up in the Deep Space Network’s Doppler data as an unexpected, large acceleration, and no such event appeared in the data. The other possibility was that the spacecraft’s attitude control thruster model was incorrect. These small thrusters kept the spacecraft in its programmed orientation and enabled the desaturation of its reaction wheels. Each time one of them fired, it imposed a small acceleration on the spacecraft in a desired direction. But the firings were never perfect—they also always produced a small acceleration in an undesired direction.
JPL-built spacecraft, like Mars Pathfinder, generally used “coupled” thrusters. Coupled thrusters were thruster pairs on opposite sides of the spacecraft that fired in unison to produce a pure rotation around the spacecraft’s center of mass. In other words, they would not produce any translation, or linear motion. Mars Pathfinder chief engineer Rob Manning commented years later that they employed this method because precision navigation was considered important to the Pathfinder project. “I wanted a quiet spacecraft that followed Kepler’s laws and did not have a mind of its own.”27 They went to the trouble of designing and calibrating a coupled-thruster system to ensure their spacecraft would be easy to fly. But Steve Jolly’s engineers had not really understood how important these small forces, as they were known, were in deep space navigation and had done what was common in Earth orbiters: used uncoupled thrusters.28 These were single thrusters that would produce both rotation and linear motion. The undesired linear motion was then calculated and, if necessary, removed in subsequent firings. For Climate Orbiter, the linear component of motion was to be calculated on the ground and compensated for during the TCMs. The Global Surveyor flight team had made these adjustments during their maneuvers without problems, so what had gone wrong when the same people had performed the calculations for Climate Orbiter?
Interviews with the navigators and operations staff led Jordan to understand that the navigators had never discovered that Climate Orbiter was not being operated in its “barbeque” spin mode as specified in the navigation documents.29 This was a key miscommunication. If Climate Orbiter had been spinning, the errors, whatever their magnitude, in its thruster calculations would have been distributed “spherically,” located as if inscribed at random points on the surface of a sphere. But in its three-axis stabilized mode, the errors would all build in specific directions. Worse, since Climate Orbiter’s thrusters fired so often to desaturate only one of the reaction wheels, due to the high solar torque produced by its solar panel, most of the error was in a single direction: toward Mars.
Still, when the thruster calculations were applied to a nonspinning Climate Orbiter, they did not put the vehicle anywhere near its actual Mars orbit. There was still a source of more error. In fact, the amount of error necessary seemed to be about 4.5 times as much as the model showed. Jordan’s panel was set up on a Friday. Over the weekend, Jordan realized that the amount of error also happened to be the same as the unit conversion necessary to turn a metric force estimate into one in English engineering units (Newtons to pounds-force). On Monday he requested a teleconference with Lockheed’s attitude control team. It took place on Tuesday; on Wednesday, Steve Jolly called Gavin to report that this had, in fact, been the error.30 Ground software used by Lockheed’s operations group to calculate the thruster forces lacked this crucial conversion factor. While the requirements document specified that the company provide the thruster data in Newton-seconds, they had actually been providing it in pounds-force-seconds.
Jordan had the navigation section run the trajectory analysis from TCM-4 to Mars using the corrected thruster data. This “yielded a trajectory 160 km closer to Mars.”31 The root cause, a simple software error, had been found.
Two other investigations started in parallel. Ed Stone had John R. Casani, recently retired after completing his assignment as Cassini-Huygens project manager, run an internal investigation. Casani focused on process. How had such an egregious error gotten through all of the checks and balances that were supposed to find and fix inevitable human errors? The second committee, appointed by NASA, was led by Arthur Stephenson of Marshall Space Flight Center. Stephenson’s committee, which got going more slowly, was rendered partly moot by the rapid discovery of the root cause. It ultimately reported on project management failures in NASA more broadly.32
Casani’s panel found there had been many opportunities to discover the problem, but they were missed and drew no corrective actions. The initial software error had been made by a “freshout” at Lockheed Martin. He had been assigned the task of revising a piece of Global Surveyor’s software, called “sm_forces,” to make it compatible with Climate Orbiter. Climate Orbiter had different thrusters, so the programmer had deleted the Global Surveyor thruster-specific code and replaced it with code corresponding to the orbiter’s thrusters. He had not realized he needed to apply the Newtons-to-pounds-force correction; while experienced aerospace engineers know that the U.S. industry is caught in a weird hybrid of English and metric systems and probably would have checked this, the fresh-out did not. And, as had also been noted in the final development report back in January, supervision at Lockheed’s plant had been weak. Nobody had told the programmer this key bit of information.
The software flaw also could have been caught during the early operational readiness tests. If these ORTs had been carried out properly, the data table being provided by the software would have been examined for correctness.33 Then the examiners would have discovered that the software was creating the table in an unreadable output format. But no one read the data table during or after the ORT. Discovered in December after launch, this format error was not fixed until April. So the erroneous data was not even being used to fly Climate Orbiter until then. The navigator, who knew about the output format error, made his own estimates of the thruster firing impulses instead.34 Once the format error was fixed, he started using the software-generated data, as it saved him work. That was why the navigation solutions only started to diverge after the third TCM. The navigator’s estimates were actually more accurate than the software’s.
The Deep Space Network’s Doppler tracking data also could have revealed the problem. The Doppler shift produced by the thruster firings was consistently about four and a half times the magnitude expected, reflecting the miscalculation. The navigation team had noticed the divergence between the Doppler data and the calculated firings in late April and asked Lockheed’s spacecraft team to investigate.35 An attitude control engineer was assigned to the problem, but at the beginning of June, Lockheed had reorganized the operations staff. That engineer went to the Stardust mission and his replacement never knew about the Doppler discrepancy. JPL and Lockheed Martin each maintain a formal problem reporting system known as incident, surprise, and anomaly (ISA), and no one filed an ISA either. ISAs must be tracked and responded to; without the formal requirements imposed by the ISA system, the Doppler issue got lost in the press of other work during the busy period preparing for Climate Orbiter’s orbit insert and Polar Lander’s site selection maneuver.
Instead, the orbiter navigator became concerned about the large “spread” among the three position solutions without connecting this issue with the anomalous Doppler results. This was likely the single most fatal disconnect among the many revealed in the investigation. Because the navigation team itself did not “connect the dots,” as it were, into a consistent story that exposed much larger uncertainties than were nominal for Mars missions, they could not convince Thurman, McNamee, and Cook that they needed to raise the orbit periapsis. McNamee, Thurman, and Cook all came from the navigation and operations sections of JPL, and they knew that 2–3 km errors were typical. Their own experience gave them a false sense of security that could only have been broken by a solid case for larger-than-expected uncertainties. And the navigation staff didn’t make one. Finally, there had been no leader for JPL’s navigation section to whom the project’s navigator could appeal after being rebuffed by the project staff during the flight to Mars; the section manager had left, and a new one wasn’t chosen until the week of the orbiter’s arrival.36 Even Cunningham’s retirement in June was ill-timed, in retrospect. He had known the navigator from many years’ service on previous missions and might have provided him with a more sympathetic ear. Climate Orbiter had suffered a perfect storm of errors, oversights, and understaffing.
Casani’s report made 14 recommendations. Central to them were inducing better communications within projects and between projects and JPL’s technical specialists (known as the “line organizations” at JPL) and restoring formalized processes and procedures that had been abandoned in the effort to do things less expensively—especially problem investigations. Arthur Stephenson’s report put essentially the same recommendations in terms of reinvigorating the discipline of systems engineering at JPL. Systems engineering was created to exert management control over complex development programs. At its core is interface control, a process to ensure all of a spacecraft’s systems would work together as intended. At least at JPL, this was understood to be more than a technical process; it’s humans that build things, and systems engineering had to ensure that adequate, and accurate, human communication occurred and kept occurring throughout a project’s life cycle.
Demise of the Polar Lander
Orbital mechanics dictated that Polar Lander would reach Mars on December 3, regardless of the outcome of the three Climate Orbiter investigations. Charles Elachi reorganized SESPD and immediately put the Surveyor Operations Project under Tom Gavin. The operations project’s navigation staff was also reinforced immediately, to ensure no other navigation problems recurred. Polar Lander did not have the same ground software as Climate Orbiter, so at least on the surface, it did not share that same risk. It also did not have the asymmetric architecture that had caused all of Climate Orbiter’s thruster firing errors to build up in the same direction. Nonetheless, Polar Lander’s flight team moved their scheduled October 10 TCM back ten days to allow a thorough scrubbing of their navigation data and process.
The increased navigation attention and staffing also led the team to discover that they had not fully understood the ramifications of the post-launch discovery of the star cameras’ stray light problem. The solution had been to keep the lander oriented slightly away from its designed Sun line, resulting in the lander’s cruise stage antenna being pointed away from Earth. So the operators had to command the spacecraft to turn toward Earth in order to transmit engineering telemetry every day. The additional firings of the uncoupled thrusters had, as they had with Climate Orbiter, built up an error that had to be removed at TCM-4. So TCM-4 had to provide a larger velocity change than originally expected.37 This didn’t seem problematic; the lander had plenty of fuel.
But TCM-4 then had an unexpectedly large execution error. The team traced it to the firing being long enough to allow a pointing error (an error in the direction of the firing’s velocity vector) to build up but not long enough to enable the attitude control system to correct it. This was another consequence of having not designed the vehicle for high-precision navigation. And TCM-5 could not be used to correct the trajectory either. So the lander’s final course would take it to the extreme western edge of the planned landing zone, which contained a crater near the northernmost extent of the ellipse.38 Extensive analysis by the navigation team, with the help of Richard Zurek, showed that the lander was not in significantly more danger than it had been. It just would not land quite where they had wanted it.
Ed Stone had also asked John Casani to set up a “red team” review of Polar Lander. This was headed by Chris Jones of JPL, who had developed the fault protection software for the Voyager spacecraft. Jones’s team looked at several potential issues in detail, one of which seemed a potential killer. Arthur Stephenson’s review committee had commented that it was not clear that Polar Lander’s descent thrusters would fire properly, and this uncertainty drew a great deal of attention.39
The terminal descent thrusters needed certain thermal conditions to exist for them to operate properly. Polar Lander used hydrazine thrusters in a mono-propellant mode. The hydrazine passed over catalyst beds, inducing a reaction that converted the liquid to a gas. The catalyst beds lost efficiency below 7°C, and hydrazine froze at 1°C, so the issue was whether the project’s thermal analysis and testing had been adequate to ensure that the catalyst beds were above that temperature when the spacecraft computer ordered the thrusters fired. Because the thrusters had to turn on and off very rapidly to control the descent, even a short “warm up” delay was intolerable. And, of course, the lander’s thermal analysis had already been impugned by the failure of the capillary pumped loop system during thermal vacuum testing. Stephenson’s group wanted this potential problem addressed.
It turned out to be a significant issue. During TCM-3 and TCM-4, the fuel outlet temperature from one tank (the other tank had no temperature sensor) did drop very close to hydrazine’s freezing temperature. So local freezing within a tank was possible, despite the operation of tank heaters. The propulsion review team also unearthed data from the cruise thermal vacuum tests done before launch that showed the catalyst beds to be at −30°C. The thrusters would not have fired at that temperature. JPL and Lockheed had the thruster contractor perform tests to determine what could be done in flight to bring the beds up to a useful temperature; these showed that activating electric heaters attached to the fuel valves several hours before landing could bring the beds up to an acceptable temperature.40 The operations team made changes to their procedures in the days before landing, resolving the problem.
Polar Lander’s descent to Mars was scheduled for the afternoon of Friday, December 3. It was a long day for the flight team because TCM-5, their contingency maneuver, had to be carried out at 4:00 a.m. Pasadena time. After examining their projected entry corridor vis-à-vis the desired landing site, they had decided to use TCM-5 to shift the projected landing spot southward slightly to improve their chances of missing the crater that was sitting on the north edge of the landing ellipse.
The landing was scheduled for 12:15 p.m.; then the team would have to wait to hear from the lander. Unlike Pathfinder, Polar Lander had no communications with Earth during its descent, so JPL wouldn’t know it had landed successfully until about a half hour had passed. Aboard the vehicle, the first 20 minutes after touchdown were devoted to deploying the solar panels and performing “gyrocompassing.” The lander needed to know what its precise orientation on the surface was in order to aim the medium-gain antenna at Earth. It figured this out by analyzing data collected from its inertial measurement unit during the descent and first few minutes on the surface.
The gyrocompassing period was critical because the antenna had to be aimed within 6° of the Earth’s true location in the sky to be detectable by the Deep Space Network’s antennae. The Monte Carlo simulations run out in Denver had shown there was a quite significant chance that it would not find Earth on its first try, and both Zurek and Sam Thurman cautioned during a press conference that they should not consider the mission lost if there was no signal. Instead, the lander had been programmed to hibernate for about seven hours if it didn’t find Earth the first time, charge its batteries, and then carry out a search pattern with the medium-gain antenna. So it was very possible that the lander could descend successfully but no one would know it until the next day.
The Deep Space 2 microprobes would also not be heard from immediately. They depended on the Mars relay aboard Global Surveyor to communicate with Earth; specifically, the relay would take the probe data, encode it as if it were a photograph, and store it in a memory area in Mike Malin’s Mars orbiter camera. Global Surveyor would then send it back to Earth, where the Deep Space Network would transmit it to Malin’s facility for decoding. Microprobe project manager Sarah Gavit’s team at JPL would first find out from Malin whether they had any data. The first pass was scheduled for 7:50 p.m., but this pass was at a low sky angle, and not hearing from either probe could simply be a product of the low overpass angle. Every two hours, Global Surveyor would fly over again, climbing higher in the sky for four passes and then descending again. So it could take nearly a day to determine whether the probes had survived, and Gavit’s small team would have no information at all when the first post-landing press conference was scheduled, at 1:30 p.m. on December 3.
JPL was transmitting Polar Lander’s descent to Mars live on NASA’s own TV channel. Perhaps due to Climate Orbiter’s failure, the mission support area in building 264 was crowded with dignitaries, too. NASA administrator Dan Goldin was there, with Ed Stone, Charles Elachi, Tom Gavin, and Chris Jones. Planetary Society executive director Lou Friedman was also in attendance, along with California congressman David Dreier. Cameras outside the mission support area at JPL, at Lockheed’s operations facility in Denver, and at Dave Paige’s lander operations room at UCLA recorded an excruciating four days for the Polar Lander and Deep Space 2 teams, and for the assembled higher-ups.
Outside JPL’s fence, the Planetary Society had organized another PlanetFest around Polar Lander’s descent. Held at the Pasadena Convention Center, the three-day event’s theme was “A New Millennium of Exploration.” Lou Friedman’s crew had gotten scientist Chris McKay to speak about the now-famous “Rock from Mars.” Ed Stone spoke on solar system exploration, and astronaut Story Musgrave presented pictures of the Earth from space. There were children’s activities, artists displaying space and Mars art, and lectures by science fiction writers.41 There were also giant television screens linked to JPL so that, as with Mars Pathfinder, Polar Lander’s arrival could be witnessed almost firsthand by the 20,000 or so attendees.
The December 3, 12:39 p.m. opening of the first communications window for Polar Lander after its descent came and went; after a few minutes without a signal, Rob Manning snuck away from the mission support area to be sick. He already believed the lander had failed and felt horrible for the team. McNamee, Thurman, Cook, and Gavit were more confident, and it was Richard Cook, the eternal optimist of the bunch, who appeared at the 1:30 press conference and told the assembled reporters that they had not heard from it.42 Cook also told them the next opportunity was a little after 8:00 p.m. that night and would last about an hour, while the medium-gain antenna went through its expanded search for Earth.
Mars Polar Lander mission support area on landing day, December 3, 1999. In the foreground are Sam Thurman (right) and mission systems lead Philip Knocke (left). Just over Knocke’s left shoulder are John McNamee (left) and NASA administrator Dan Goldin (right), sitting. Standing behind McNamee to his left is Charles Elachi, Matthew Landano of JPL’s mission assurance organization, and Richard Zurek (arms crossed). Standing above Goldin’s right shoulder is NASA associate administrator Ed Weiler (arms crossed). JPL director Ed Stone, Tom Gavin, and John Casani are visible in the back row behind Elachi. Charles Whetsel is standing under the TV monitor in the upper left.
JPL D-120399B7, courtesy NASA/JPL-Caltech.
JPL held another press conference at 10:40 that night, originally expecting that there would be data from Polar Lander and the Deep Space 2 probes, but there were none. Gavit’s project engineer had bounded into the mission support area an hour before the 7:50 Global Surveyor pass all smiles, but as she and everyone else there heard Mike Malin over the speaker announcing no probe data from the Mars relay’s first pass, her mood turned tense, too.43 Gavit joined Cook on the stage at Von Karman this time, to explain that it wasn’t really surprising that this low angle pass did not hear anything from the probes.44
But by the evening of the next day Gavit’s team largely understood they had not succeeded; while they had to spend the night of the third in the mission support area to hear the null result of each successive communications pass, for the Polar Lander team the next opportunity was not until the evening of December 4. The Polar Lander team reassembled for this opportunity, with many of the dignitaries still in attendance. Chris Jones spent a lot of time explaining to the television audience what was happening and what Polar Lander might be doing at its south pole perch, but the communications window came and went with nothing received. Cook, Gavit, and Sam Thurman faced the Von Karman audience together at a 9:40 p.m. press conference.45
Cook explained that there were several more opportunities to communicate with Polar Lander over the next two days, but the last pre-programmed communications window was on December 7. By that time, the lander would have attempted to communicate via the Mars relay on Global Surveyor, as well as by its own medium-gain antenna, and the operations team would have tried each variation of search command available to them. He and his team reassembled for each communications window, with a diminishing group of spectators. They didn’t hear anything.
On December 7, Ed Stone began the painful process of notifying all the Mars program’s stakeholders, to use a popular bit of management jargon, of the probable loss, with an address to Caltech’s Board of Trustees. He explained what had happened to Climate Orbiter in some detail, and the corrective actions taken, apparently in vain, to ensure Polar Lander didn’t suffer a similar fate.46 On the December 9 he went to Washington to take responsibility for the two mission’s failures.
On the flight back to Pasadena the next day, he composed an address for a town hall meeting in JPL’s Von Karman auditorium. His audience greeted him with a standing ovation that took a few minutes to quiet down. Then he told them that his chief concern was that JPL, and NASA, would learn the right lessons from the losses. “Scrutiny and criticism can be good things. We are accustomed to this as an internal exercise,” he said. “We excel at ‘finding the flaw, and then fixing the problem’ because this activity helps insure mission success.”47 The magnitude of the Lab’s failure meant that this normal internal process would be applied from the outside, too, by NASA. There would be many critical reviews of all sorts of things in the coming months.
Recriminations and More Investigations
Public reaction to the Polar Lander’s loss was harsh. Television comedian David Letterman had a mockup of the vehicle crash onto his stage during one show. Myriad political cartoons about it appeared in newspapers and magazines, and on the Internet. Some were sympathetic to the team, but many were harsh condemnations of NASA or faster, better, cheaper, or both.
Long before JPL finally gave up looking for Polar Lander, recriminations about the Surveyor 1998 project had started. On December 8, already tired of attacks from inside JPL about the lack of telemetry during Polar Lander’s descent, John McNamee had written a lengthy e-mail to Ed Stone and many others explaining the decision. From its beginning, the project’s financial and mass constraints mitigated against anything that was not directly concerned with “getting a spacecraft safely to its’ [sic] destination and conducting science operations with that spacecraft.”48 Telemetry during entry, descent, and landing did nothing to improve the chances of the lander succeeding—it would only improve the chances of future landers succeeding. So “absent a Program level requirement to have a downlink during EDL,” his team had not pursued one. That decision had been explained at many reviews, to both JPL and NASA management. It should not have been a surprise.
The lack of telemetry left the inevitable investigation with little data to work with. Ed Stone gave the unenviable task of investigation to John Casani, who assembled a diverse technical committee to review all aspects of the design. There were many potential points of failure to address: if the cruise stage had never separated from the lander, none of the vehicles would have survived entry. If the lander heat shield, parachute, radar, or descent thrusters had failed, Polar Lander would never have been heard from (although none of these would have affected the probes). The lander could have landed safely, but if the solar panels had not deployed, they would have prevented communication via both medium-gain and UHF antennae—again, this wouldn’t have affected the microprobes, so Casani’s team had to postulate independent failures for those. Because they had so many potential failure modes, they didn’t get much traction on the problem for several weeks. Their breakthrough came from George Pace’s Surveyor 2001 project.
In February, during testing of the 2001 lander’s leg extension process out in Denver, technicians noticed that the legs rebounded slightly after reaching full extension.49 That rebound caused the sensors that sensed touchdown on the surface to send a false touchdown signal to the flight computer, which was stored in memory. The legs deployed while the lander was still on the parachute, so nothing would have happened immediately. But in the actual mission, when the computer released the parachute and started the descent thrusters, it would start looking for that touchdown signal, find it already in memory, and shut the engines off again—while still around 40 meters above the surface.
Roger Gibbs, George Pace’s spacecraft manager, had the test run 47 times. In 32 cases, the leg sensors generated the spurious signal.50 Tests run on the engineering models of the Polar Lander’s legs also generated spurious signals. So it looked like in the majority of cases, the 2001 lander would have crashed. Since it was a rebuild of Polar Lander’s design, this finding implied that it was also likely to have been the fatal moment for Polar Lander.
Lockheed’s Parker Stafford reflected years later that he had realized this possibility might exist but that it was easy enough to solve by wiping the memory address for this “touchdown flag,” as it was called, immediately after the legs deployed.51 There was plenty of time to do this, relatively speaking. The wipe would take a microsecond, and the lander rode the parachute for more than a minute after leg deployment. The memory wipe never became part of the requirements that specified how the software was to work, however, so it hadn’t been implemented.
Casani’s committee gave leg extension triggering premature engine shutdown as the likely cause of Polar Lander’s loss, but they also specified six other potential failure modes as “plausible,” based on examination of the lander design and the project’s testing documents. Further, they found areas where the lander test program had been inadequate to ensure the proper operation of subsystems, such as the heat shield ejection mechanisms, and criticized Lockheed for use of excessive overtime. “Records show[ed] that much of the development staff worked 60 hours per week, and a few worked 80 hours per week, for extended periods of time.” The manpower shortage also meant that some technical areas had only one person working them, leading to inadequate peer interaction. So “there was insufficient time to reflect on what may be the unintended consequences of day-to-day decisions.”52
The landing leg fault did not explain the silence of the Deep Space 2 microprobes, and the lack of data there was even more daunting for the investigation. With Polar Lander, the committee at least knew the lander’s status up to the moment at which its telecommunications had shut down prior to cruise stage separation. The probes had no communication with anyone from the moment they had been attached to the cruise stage back in Florida, so it was impossible to know whether they had even survived the flight to Mars. But based on the possibility that the surface conditions were not as expected, the committee postulated that they had either bounced or landed on their sides, preventing communications. They could also have suffered electronic or battery failure on impact, as the flight lot of batteries had not been impact tested. Finally, the probe electronics had not been tested in the low-pressure Mars atmosphere, and very low pressures could induce electronic failure.53 The board also was not satisfied by the lack of an end-to-end test of a complete probe, although they did not list this is a potential cause of the loss.
Years later, Sarah Gavit would point out that Casani’s report was unusual for an aerospace investigation. Typically investigators look for a single point of failure that could explain all of the evidence. In the context of Polar Lander and the Deep Space 2 probes, the only single fault that could explain the total lack of communications with any of the three vehicles was failure of the cruise stage to separate from the lander’s aeroshell.54 Because the mechanical movement of the aeroshell away from the cruise stage was the trigger for probe deployment, the probes would not have deployed either. All four of the vehicles would then have been destroyed in the martian atmosphere. Casani had rejected this scenario because the pyrotechnics that trigger the release are extraordinarily reliable, and the electronics that commanded the pyrotechnics had been properly designed and tested. To her, the question of what had actually happened remained an open one. Several years later, the Phoenix project would discover that she had probably been correct.
In addition to the JPL special review board led by Casani, Dan Goldin asked A. Thomas Young, recently retired as executive vice president of Lockheed Martin and once the operations manager for the Viking project, to chair a broader review of the Mars program. This panel came to three major conclusions. First, McNamee’s project had been substantially underfinanced. Using Mars Pathfinder as their standard for a minimum successful project, they figured the Surveyor 1998 project had been underfunded by at least 30 percent.55 This had led to inadequate staffing, testing, and training.
Second, poor communications had hobbled the project and the Mars program overall. The Mars Exploration Directorate at JPL had seen NASA’s requirements regarding costs, schedule, and launch vehicles as nonnegotiable. Fear of losing the planetary science business, JPL’s primary role in NASA, to competitors at Ames Research Center and the Applied Physics Lab caused JPL’s senior management to downplay the risk the project faced. Thus, “what NASA Headquarters heard was JPL agreeing with and accepting objectives, requirements, and constraints.”56 The requirements creep on the Mars Surveyor 1998 and 2001 projects was a product of JPL senior management not “pushing back” against additional requirements until Tony Spear’s intervention. This had been further exacerbated by a complex reporting relationship between the Mars office and NASA headquarters, where Norm Haynes had to deal with four different officials within the Space Science Enterprise, plus others in the Human Exploration and Development of Space Enterprise, for the experiments on the Surveyor 2001 missions.
JPL had made the communications channels worse still in its own 1999 reorganization. The Mars program director no longer reported to the JPL director, and the Mars Surveyor project managers no longer reported to the Mars program office. The resulting lack of senior management attention was inadequate. Young’s team concluded that “the current organization is not appropriate to successfully implement the Mars Surveyor Program in combination with other commitments.”57
Finally, the panel reinforced what Tony Spear’s 1998 review had concluded. The program had not succeeded in creating a “Mars architecture” that would permit continuous evolution of appropriate technologies, with each project contributing to capabilities needed for the longer-term goal of sample return. This, of course, had a lot to do with poor communications between and among NASA, JPL, and the individual projects. JPL had not succeeded in communicating to headquarters officials the substantial technical differences between the Mars projects, leaving headquarters officials confused as to why Surveyor 2001 and the sample return project had such high cost projections.
But the panel was also careful to conclude that faster, better, cheaper itself had not failed (although they admitted no one could find a definition of faster, better, cheaper, so they made up their own).58 Mars Pathfinder and Global Surveyor had succeeded, as had the New Millennium program’s Deep Space 1, launched late in 1998. So JPL could implement such projects. But not for the aggressively low cost of the Surveyor 1998 missions, and not given the managerial relations that existed between and within NASA and JPL. In particular, JPL senior management had to take a stronger role in project management and in dealing with NASA headquarters. So the Young panel’s view was that faster, better, cheaper could continue to be policy, with around one-third higher budgets and significantly increased management attention.
A Nature editorial did not let NASA off quite as lightly. “The political realities of the Mars programme were not misinterpreted by the JPL engineers and scientists in the trenches. They understood that they could not ask for more money, nor could they radically ‘descope’ their missions. Their only choice was to sigh and accept more risk. That, or resign.”59 Perhaps understanding that this was the reality of the faster-better-cheaper drive he’d created, on March 28 Goldin took McNamee, Cook, Gavit, Thurman, and their teams out to dinner at Monty’s restaurant in Old Town Pasadena to apologize. The next day, he made his apology public in a speech at JPL that NASA broadcast on its national TV channel: “I told them that in my effort to empower people, I pushed too hard, and in so doing, stretched the system too thin. It wasn’t intentional. It wasn’t malicious. I believed in the vision … but it may have made failure inevitable.”60
Conclusion
Down at the annual Lunar and Planetary Science Conference in Houston, held each March since 1970, Carl Pilcher discussed the ramifications of the demise of Climate Orbiter and Polar Lander with the assembled scientists. As many expected, he essentially admitted that Mars sample return was no longer likely anytime soon. And he confirmed that the Surveyor 2001 lander was likely to be cancelled. But the 2001 orbiter would still fly on schedule, probably. His meeting was held in sight of a giant new topographic map of Mars being shown off by a beaming David Smith, created from a little over an Earth year’s worth of his laser altimeter data.61
The twin losses forced what Rob Manning called a “reality check” on the Mars program, and on the cost-cutting fervor fostered by faster, better, cheaper. While feeling horrible for John McNamee, Sam Thurman, Sarah Gavit, and their teams, he knew that he could never deliver the giant-sized sample return landers for anything like the $130 million budget he’d been given. Polar Lander’s failure had left NASA and JPL management with no confidence in the basic Lockheed Martin design that formed the basis of the Mars landers, and Wes Huntress’s successor as associate administrator for space science, Edward J. Weiler, said as much to Aviation Week reporters.62 Manning’s conscience was relieved, although it meant he, along with the rest of the 2005 sample return project, no longer had a job to do.
George Pace also understood the Lockheed lander design no longer had any credibility. But he saw his job as project manager with a nearly finished lander—by January 2000 nearly all the 2001 lander hardware had been delivered, and the spacecraft team was well along in putting it together—as restoring the design’s credibility. So while sample return was evaporating, Pace, Roger Gibbs, and their counterparts at Lockheed were absorbing the recommendations of the failure investigations and trying to figure out how to implement them. By March they had to have a recovery plan to present to whoever wound up in charge of the reorganized Mars program.
Faster, better, cheaper had been predicated on accepting more risk, including risk of occasional mission failure. Goldin had thought that as long as most missions succeeded, Congress and the public would accept the failures as a normal cost of doing business. That seemed to be true in the defense world, where the major media routinely ignored the occasional loss of military satellites, even those costing many times what the Surveyor 1998 missions had.63 David Letterman didn’t pillory the Pentagon for a billion-dollar spy satellite lost in 1998; at a tenth the cost, Polar Lander drew far more public derision. NASA had also lost a small astronomy explorer, WIRE, in 1999, without much attention. So the public eye was less trained on NASA in general than on Mars in particular.
Goldin had realized that Mars was popular. He hadn’t really understood, though, how the word “Mars” would focus national attention on both success and failure. Risk turned out not to be acceptable for the Red Planet.