02. Units and Assumptions — The Mismatch Nobody Owns

The Boundary as a Point of Failure

Complex systems do not fail at their singular, well-defended cores because those areas are subject to rigorous internal verification processes. Instead, these systems collapse at the invisible interface where two distinct, correctly functioning components are forced to exchange critical data. The Mars Climate Orbiter disaster in September 1999 illustrates this, as ground software transmitted thruster impulses using the unit of pound-force-seconds. The navigation system, however, was built to interpret these specific inputs only as Newton-seconds, creating a 4.45x conversion mismatch that remained entirely unobserved. The NASA Mishap Investigation Board confirmed that each subsystem was perfectly valid against its own local specification, yet no entity owned the interface. The lack of a unified authority over the handoff meant the defect existed in the space between the two otherwise functional, compliant engineering teams.

The Cost of Implicit Assumptions

In June 1996, the Ariane 5 Flight 501 failure demonstrated how software reuse can introduce fatal risks when the original context is ignored. The Inquiry Board chaired by Prof. Jacques-Louis Lions discovered that the inertial-alignment software was inherited directly from the previous Ariane 4 rocket design. A 64-bit horizontal-velocity value was passed into a 16-bit integer, causing an unprotected conversion overflow that the system was never designed to handle safely. Similarly, in July 1983, the Gimli Glider incident occurred because the ground crew utilized a fuel-density conversion factor for pounds instead of kilograms. The Board of Inquiry led by George H. Lockwood noted that the crew applied a 1.77 factor instead of the required 0.803 kg/L. This error left the aircraft with under half the required fuel because both sides assumed their unit convention was the universal standard for all calculations.

The Consensus of Investigations

There is no serious dispute regarding these findings, as the official investigations agree that the mechanisms of failure were entirely tied to mismatched assumptions. The NASA Mishap Investigation Board, the Inquiry Board led by Prof. Jacques-Louis Lions, and the Board of Inquiry led by George H. Lockwood all concur. Each body confirmed that the technical failure occurred because the interface was not treated as a distinct, owned component of the total system.

Example: A bridge fails not because the steel is weak, but because the architect and the engineer used different units for the load.

Verdict. Reliability is a property of the boundary, and a defect that lacks an owner will inevitably remain hidden until the system reaches a failure state.

Overturned if: A future analysis demonstrates that the Ariane 5 software overflow was successfully caught by the existing unit testing protocols during the flight preparation phase.

Sources. 1999 · NASA Mishap Investigation Board, "Mars Climate Orbiter Mishap Investigation Board Phase I Report" — NASA report PDF · 1996 · Inquiry Board (chair J.-L. Lions), "ARIANE 5 Flight 501 Failure — Report by the Inquiry Board" — ESA