Chapter 7
Decomposition as Design
In 1999, NASA lost a $327 million spacecraft because two teams used different units at their shared boundary. Lockheed Martin, building the Mars Climate Orbiter, produced thruster impulse data in pound-force-seconds. JPL, navigating it, expected newton-seconds. The values differ by a factor of 4.45. Neither team’s work was wrong. Both were competent within their own domain. The boundary between them lacked a single constraint — a typed interface specifying units — and the spacecraft entered the Martian atmosphere at the wrong altitude because nothing governed what crossed the seam. The failure investigation identified eight contributing factors, and every one traced back to the same architectural absence: no ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access