In our series on declining engineering rigor, we’re exploring how a “culture of convenience” and a failure to question assumptions can lead to catastrophe. Few places demonstrate the stakes of this problem and the solution better than space exploration. Two of NASA’s most famous missions, one a tragic loss and the other a near-total failure, serve as the ultimate case studies in the cost of unverified assumptions.
The navigation room at JPL is too bright for 2 a.m. The plots on the wall look clean until one thin line begins to drift. It’s September 23, 1999, the morning of Mars Climate Orbiter’s insertion into Mars orbit. Radio lag forces everyone to live in the past by minutes, but the math is here now, and it is uncompromising. A flight dynamics engineer squints, then stands. The last delta-V estimates aren’t matching the expected corridor. If their altitude is off by tens of kilometers, Mars won’t be an orbiter; it will be a shred of metal and insulation.
The probe is not only a weather scout. It’s also a communications relay for the soon-to-arrive lander. One spacecraft means two missions’ worth of dependency. The board room number is the one no one wants to say out loud: $327.6 million in project cost on the line, with no pause button to press.
In a different decade and a different room, in Perkin-Elmer’s optical lab in the late 1980s, a technician slides a gleaming assembly called a null corrector into position. It’s the master template that tells a polishing machine when a meter-class mirror is “perfect.” The device says the mirror is flawless. Later, Hubble’s first images say otherwise: stars blur into doughnuts. Somewhere, the calibrator that certifies perfection wasn’t perfect at all.
Two scenes, one question the teams can’t dodge: What if the interface lies and the instrument that verifies it lies, too?
At JPL, the trajectory errors trace back to a banal villain: units. A ground-side program produced impulse data in pound-seconds, while the navigation software expected newton-seconds. Numbers flowed, tests ran, doors opened, and the mismatch slipped through reviews as “nominal.” It wasn’t. The orbiter arrived too low and was lost during orbit insertion.
Hubble’s mirror flaw wasn’t a rough job; it was precisely wrong. The null corrector’s lens spacing was off by about 1.3 mm, so the polishing machine drove the primary to the wrong figure with exquisite consistency. The error at the edge? About 2.2 microns thinner than a flake of paint, enough to wreck contrast. Contradictory benches warned of trouble but were discounted because the “gold-standard” jig said all was well.
The MCO board found gaps in end-to-end interface control and verification; no single review stitched the assumptions across software, operations, and navigation into one chain of custody. On Hubble, optical metrology and QA did not force a second, independent path to “yes.” Both programs were busy, both were professional, and both normalized a fragile shortcut.
Space makes errors cinematic. Business makes them recurring.
Translate that to an executive scoreboard: margin volatility from defects, cash burn from rework and field campaigns, risk from reputation loss. Whether it’s a telescope or a turbine line, a bad interface or a mis-calibrated jig shows up as change failure rate ↑, FPY ↓, iteration velocity ↓, and a creeping culture of firefighting.
The counterfactual isn’t complicated:
One before/after KPI callout:
And when rigor compounds, you get a Hubble-in-reverse: JWST’s alignment hit milestones cleanly; teams declared optics “working successfully,” then delivered first-light images on schedule.
A European satellite builder noticed a pattern: late-stage vibration tests kept failing “mysteriously.” Systems blamed structures; structures blamed payload; payload blamed a “quirky” shaker. The COO greenlit a two-week intervention:
The second-source check found a drifted accelerometer inside the shaker table, just enough to under-report peaks and push teams into false fixes. The interface contracts caught a unit slip between two analysis tools. Tests stabilized; tempers cooled.
KPI snippet:
Not heroic. Just math, physics, and independence.
This chapter closed out testing discipline in space, the cost of assuming versus the payoff from independent verification. Next: Part 6 moves from orbit to the freeway: are today’s autonomous driving stacks being tested with the same cross-disciplinary rigor that saved Hubble and made JWST sing?
[1] NASA Science — Mars Climate Orbiter. Mission purpose, loss, relay role. Updated page. (NASA Science)
[2] NASA LLIS — MCO Mishap Investigation (Phase I, PDF). Root cause: unit mismatch; verification/ICD gaps. 1999. (llis.nasa.gov)
[3] NASA Science — Hubble’s Mirror Flaw. Null-corrector spacing error; spherical aberration. explainer. (NASA Science)
[4] NASA History — HST Servicing Mission (Chapter 16). Repair scale (~$500M), record five EVAs, ~11-day mission. (NASA)
[5] NASA OIG — IV&V of Software (IG-03-011, 2003). IV&V as critical management control post-MCO/MPL. (oig.nasa.gov)
[6] NASA News — JWST Alignment Milestone (2022-03-16). “Optics working successfully” counterexample where rigor worked. (NASA)
