Curriculum·R411 Building, Validating, and Operating Your Own Automation·about 32 min
From rules to code
By the end of this lesson you can
- →Separate the rule from its encoding, and name where the loss actually occurs
- →Specify the units and the reference quantity for every parameter before writing anything
- →Compute what a units error costs when it passes between two components
- →Write the interface contract between components, because that is where errors live
Senior · enrolled learners
This lesson opens with The Mars Climate Orbiter, 23 September 1999.
- What happened
- The Mars Climate Orbiter launched on 11 December 1998 and fired its main engine for about sixteen minutes on 23 September 1999 to enter Martian orbit, after which contact was lost. The mishap investigation board found that one team supplied thruster impulse values in pound-force seconds while the navigation software expected newton-seconds. Because one pound-force is about 4.44822 newtons, the navigation computations read every impulse as substantially smaller than it was, and the accumulated trajectory error placed the spacecraft on a path entering the atmosphere at roughly 57 kilometres of altitude rather than the intended figure near 226. The spacecraft was destroyed and about $125M was lost.
- The decision point
- Each piece of software computed what it was written to compute, on the units its own team used, and each looked right from inside. The written interface specification called for SI units, the ground software's output did not follow it, and nothing at the boundary checked. The loss occurred entirely at the interface between them, where a requirement that was on paper was never enforced. Every automated strategy has the same seam, between the rule as you wrote it and the code as it executes, and per part three the errors that live there do not look like errors on either side.
- Recorded loss
- $125,000,000
What you will be able to answer
- →Where does the loss actually occur?
- →What must every parameter carry?
- →What does a reference error cost?
- →What is an interface contract?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://en.wikipedia.org/wiki/Mars_Climate_Orbiter
- https://www.simscale.com/blog/nasa-mars-climate-orbiter-metric/
- https://spark.iop.org/why-getting-your-units-right-matters
- https://www.esa.int/Newsroom/Press_Releases/Ariane_501_-_Presentation_of_Inquiry_Board_report
Confidence high·Volatility low·Reviewed 2026-08-07·Owner unassigned
Contested
Reported insertion altitudes for the Mars Climate Orbiter vary between about 57 kilometres and about 60, against an intended figure near 226, and the cost depends on what is counted: SimScale gives $125M as the cost of building the orbiter, while Wikipedia gives $327.6M for the mission including $193.1M of spacecraft development, $42.8M of operations and $91.7M for launch. The lesson uses $125M. The units mismatch is the investigation board's finding and is not in dispute; Wikipedia records that the ground software's output contradicted the Software Interface Specification, which called for SI units, so the requirement existed on paper and was not met.
This lesson uses two spaceflight cases because the interface failure mode is documented there with a precision no trading incident matches publicly. The mechanism transfers exactly and per P6 pretending a trading example of equal rigour exists would be the failure R405 warns about.
R405-02 owns specification and the reproduction test. This lesson owns the translation of a specification into executable form and the seam between components. Keep the split.