Unit Errors That Cost Real Money: Mars Climate Orbiter and the Gimli Glider

Two disasters, one root cause

Neither incident below was caused by a wrong number. Both were caused by a correct number with no unit attached, consumed by someone who assumed a different one. That distinction matters: a wrong conversion factor is a math error, easy to catch by checking the arithmetic. A missing or mismatched unit label passes every arithmetic check, because the numbers being multiplied are all correct — the software, the spreadsheet, the calculation all execute exactly as written. The mistake lives entirely in what a human assumed the number meant.

September 1999: a Mars orbiter arrives 169 kilometres too low

Mars Climate Orbiter left Earth on 11 December 1998, part of a NASA program to study the Martian atmosphere and climate. Its trajectory to Mars required small course corrections along the way, and periodic firings of its attitude-control thrusters to desaturate the spacecraft's reaction wheels — a routine housekeeping task, performed roughly ten times a day for the whole nine-and-a-half-month cruise.

The software that modelled the effect of each thruster firing was written by Lockheed Martin Astronautics, the spacecraft's builder, and the mission's software interface specification required it to output the resulting impulse (thrust multiplied by burn time) in newton-seconds, the SI unit. Lockheed's ground software, a file called SM_FORCES, instead wrote its results in pound-force-seconds, the customary equivalent. It wrote that file into another one, the AMD file, that JPL's navigation team read as input to their trajectory model — and JPL's model assumed, per the specification, that the numbers it was reading were already in newton-seconds. One pound-force-second equals approximately 4.45 newton-seconds, so every one of those thruster firings, for nine and a half months, was modelled as roughly 4.45 times weaker than the real impulse the spacecraft actually received. Nobody caught it, because both sides of the exchange were internally consistent: Lockheed's numbers were correct pound-force-seconds, JPL's model correctly processed whatever numbers arrived as newton-seconds. The file format had no unit field.

The spacecraft was targeted to pass 226 km above the Martian surface at orbit insertion — close enough for the burn to work, far enough to stay above the atmosphere. About 24 hours before arrival, updated tracking data (still built on the same uncorrected trajectory model) put the predicted altitude nearer 110 km, alarmingly low but still, by the team's understanding at the time, above the roughly 80–90 km altitude at which atmospheric forces would become dangerous. The Mishap Investigation Board's post-loss reconstruction, using the last telemetry actually received, put the real altitude closer to 57 km — low enough that atmospheric heating and drag likely destroyed the spacecraft or knocked it onto an escape trajectory out of Mars orbit entirely. Contact was lost at 09:04:52 UTC on 23 September 1999, as the orbiter passed behind Mars for the insertion burn; it never re-emerged. The Board's Phase I report, released 10 November 1999, named the root cause plainly: one team's software produced English units where the interface specification called for metric, and no verification step in the trajectory-modelling process was checking the physical units of the data it consumed, only its numeric plausibility.

The spacecraft itself is commonly reported as a $125 million loss — a figure that should not be confused with the $327.6 million total cost of the broader Mars Surveyor '98 program, which also funded the separate Mars Polar Lander (lost in a different, unrelated accident three months later). The orbiter-specific figure is the one to cite for this incident.

July 1983: a density figure survives the wrong unit

Air Canada Flight 143, a Boeing 767 en route from Montreal to Edmonton on 23 July 1983, ran out of fuel at 41,000 feet over Red Lake, Ontario, and glided to an emergency landing at a decommissioned air force runway at Gimli, Manitoba — with 69 people aboard and, remarkably, no fatalities. The proximate cause was a broken fuel-quantity gauge; the reason the crew went ahead and departed anyway, having calculated the fuel load manually, is the unit story.

This 767 was one of Air Canada's first aircraft to operate in the metric units Canada's aviation industry had just adopted — fuel in kilograms and litres, not the pounds and gallons the airline's older fleet and its ground crews had used for decades. With the gauge inoperative, ground crew measured the fuel already in the tanks by dripstick, a mechanical measurement, and converted that reading to a volume of 7,682 litres. To work out how much more fuel to add, they needed the mass of fuel already aboard, and used a conversion factor of 1.77 to turn litres into mass — a real, correct figure for the density of Jet A-1 fuel, but correct only as 1.77 pounds per litre. Believing they were working in kilograms per litre, as the rest of the fuelling process now required, the crew and refuelling contractor treated 1.77 as if it were 1.77 kilograms per litre, a number about 2.2 times too high.

The flight needed 22,300 kg of fuel in total. Using the wrong density, 7,682 L was calculated to already contain 13,597 "kilograms" (actually pounds), leaving 8,703 "kilograms" still needed — converted back to a volume using the same wrong factor, 4,917 L, which is what was actually pumped aboard. The tanks held 12,599 L of real fuel when the aircraft departed, weighing roughly 10,100 kg at the true 0.803 kg/L density: not enough to reach Edmonton.

Worked derivation: why the shortfall wasn't random

The arithmetic behind the Gimli fuelling error has a striking property once written out algebraically. Let V₁ be the correctly dripsticked fuel already aboard (7,682 L, never in question), ρ the true density (0.803 kg/L) and k the pounds-to-kilograms ratio (≈2.20462, since the wrong factor 1.77 lb/L equals ρ × k). The crew computed:

Additional volume to load, V₂ = [22,300 − V₁×ρ×k] ÷ (ρ×k)

Total volume loaded, V₁+V₂ = 22,300 ÷ (ρ×k)

V₁ cancels out completely. The correct dripstick reading never mattered to the final total — the flawed density factor alone determined it. Actual mass loaded = (V₁+V₂) × ρ = 22,300 ÷ k = 22,300 ÷ 2.20462 ≈ 10,113 kg. Convert that back to pounds and it comes out to almost exactly 22,300 lb — the crew's kilogram target, delivered in pounds instead. This is not a coincidence: whenever a single wrong unit-conversion factor is applied consistently on both sides of a "what I have, what I still need" calculation, the result lands on the original target number, just measured in the other unit. The plane carried the number 22,300 — the crew simply never learned which unit it was attached to until the engines flamed out.

Captain Bob Pearson, an experienced glider pilot outside his day job, used a forward-slip manoeuvre — crossing the controls to increase drag without gaining speed — to bleed off altitude on final approach and land the powerless 767 safely. Ten people sustained minor injuries during the evacuation; no one died. Air Canada's internal review and the era's Aviation Safety Board (predecessor to today's Transportation Safety Board of Canada) both pointed to the same underlying failure as Mars Climate Orbiter would sixteen years later: a correct number, and a process with no check for which unit it belonged to.

What the two incidents share

Neither failure needed a bad number. Both needed a number nobody double-checked the label on, at exactly the point where two different unit conventions met.