Failure intelligence, not failure trivia
F Failurepedia

Aerospace and Space Exploration

Lewis spacecraft

Lewis was a NASA Earth-observation satellite built by TRW under the Small Spacecraft Technology Initiative, NASA's "faster, better, cheaper" push to prove that small satellites could be built fast and cheap with minimal government oversight. It launched successfully on August 23, 1997, but within three days a flawed attitude-control safe mode let the spacecraft spin out of control and point its solar arrays away from the sun. The battery drained, ground controllers never regained contact, and the spacecraft reentered the atmosphere and was destroyed on September 28, 1997, without returning any usable science data.

Failed launch Failed initiative Moderate
Company
NASA
Started
1997-08-23
Ended
1997-09-28
Time from launch to the fatal uncontrolled spin
3 days
Collapse speed
Sudden
Preventability
High
Lesson transfer
Industry-wide
Last reviewed
2026-08-17

Narrative

The story

The ambition

Lewis was built to demonstrate that NASA could develop a capable small satellite fast and cheap, with most of the engineering judgment left to the contractor rather than the government. It was part of the Small Spacecraft Technology Initiative, an experimental program meant to validate "faster, better, cheaper" acquisition by handing a contractor broad autonomy and minimal government oversight in exchange for speed and lower cost. NASA awarded the spacecraft contract to TRW in June 1994 for $57,940,026, on a two-year schedule with no government-directed technical requirements and severe fee penalties for cost or schedule overruns. The 288-kilogram satellite was designed to carry a first-of-its-kind spaceflight hyperspectral imager, a linear etalon imaging spectral array, and an ultraviolet cosmic-background astronomy instrument, observing Earth from a planned 523-kilometer orbit for one to three years.

The rise

The program did not stay simple. NASA changed the required on-orbit life from three years to a five-year goal, and the original Pegasus XL launch vehicle was replaced by the Lockheed-Martin Athena I after the Pegasus program suffered a failure, both changes made without a matching increase in program resources. In May 1996 NASA and TRW settled on a cost cap of $64,800,000 for the whole effort. TRW moved most of the program from its Chantilly, Virginia facility to Redondo Beach, California in early 1995, but left the attitude control system engineering and the ground operations team behind in Chantilly, separated from the rest of the spacecraft's development and from Redondo Beach's functional review structure. The company also cycled through four division managers and four program managers in fourteen months. Despite the turbulence, the spacecraft itself was completed on schedule; the delay to launch came from the launch vehicle, not the satellite. Lewis finally lifted off from Vandenberg Air Force Base on August 23, 1997, and reached its 300-kilometer parking orbit with nominal performance from the launch vehicle.

The cracks

Ground controllers recorded roughly twelve anomalies in the first four days after launch. Most were resolved, but two went unexplained: an unplanned autonomous switch to the spacecraft's backup processor shortly after launch, and a solid-state recorder that would not play back the data it had captured during ascent, so the cause of the processor switch was never pinned down. On August 25 a third anomaly followed. Ground stations lost contact for two full orbits, and when contact was reestablished the spacecraft was found in an uncontrolled attitude, off-pointed from the sun by about 28 degrees, its battery at 43 percent depth of discharge. Controllers restored the spacecraft to its built-in Safe Mode and, after watching it hold stable for four hours, ended operations for the day and left it unattended for roughly nine hours. The operations team never declared a spacecraft emergency, even though the mission was still in its first days in a low, unstable orbit and had already lost its launch telemetry to a recorder failure it could not explain.

The collapse

The Safe Mode that the crew was relying on had a design flaw nobody had caught. It kept the spacecraft's intermediate axis pointed at the sun using a single two-axis gyroscope that could not sense rotation about that same axis, an approach carried over from an earlier spacecraft, the Total Ozone Mapping Spectrometer, whose safe mode pointed a different, stable axis at the sun instead. A small thruster imbalance was enough to spin Lewis up around the axis the gyro could not see. On August 26, roughly four hours after the crew's planned overnight gap in ground coverage, the spacecraft went into a flat spin at about two revolutions per minute, rotating its solar arrays edge-on to the sun. The excessive thruster firings that resulted tripped an automatic shutdown, first on one redundant thruster string and then the other, leaving the spacecraft with no attitude control at all while its battery kept draining. By the last contact pass the battery was at 82 percent depth of discharge. Working under extreme time pressure in a five-minute ground-station window, the crew sent three short thruster pulses meant to arrest the spin; only the first executed, because the next two commands were addressed incorrectly. The spacecraft went out of range and was never heard from again. It reentered the atmosphere over the South Atlantic Ocean and was destroyed on September 28, 1997, thirty-six days after launch, having returned no usable science data.

The aftermath

A NASA-chartered Mission Failure Investigation Board, chaired by Christine Anderson of the Air Force Research Laboratory, interviewed the people involved and reported on February 12, 1998. It found the direct cause of the loss was the technically flawed Safe Mode design, made fatal by the operations team's reliance on an unproven mode and by inadequate monitoring of the spacecraft during its first, most vulnerable days. The pre-launch validation of that Safe Mode had never modeled a thruster imbalance and had been ground-tested for only 100 minutes, far short of the mode's 72-hour design requirement. The board also pointed to indirect, programmatic causes: requirement changes made without matching resources, cost and schedule pressure that pushed TRW toward single-shift ground operations as a cost-saving measure NASA did not know about until after the failure, the physical and organizational split between the attitude-control team and the rest of the program, heavy personnel turnover, and a shrinking cadence of independent technical review as the program matured.

The lessons

The board's headline finding was narrow and technical, a safe mode that could not sense motion around its own control axis, but the report spent more space on how that flaw survived to launch unchallenged. It endorsed "faster, better, cheaper" as a philosophy while concluding that NASA and TRW had never reached a shared, working understanding of what reduced government oversight was supposed to mean in practice. Individually small risks, a requirement change here, a personnel change there, a training simulator never funded, went unmanaged and compounded into a mission-ending failure. Lewis shows the same era, the same cost and schedule pressure, and largely the same failure pattern as Mars Climate Orbiter and Mars Polar Lander, but without a Mars-mission budget or a planetary encounter to make it famous: an unvalidated safety mechanism, a thin operations crew, and a program structure that had traded away the checks needed to catch either before launch.

Causal timeline

Failure Anatomy

  1. 1994-06-08

    Contract awarded under "faster, better, cheaper"

    NASA awards TRW a $57,940,026 contract to build, launch, and operate Lewis under the Small Spacecraft Technology Initiative, with minimal government-directed technical requirements and a two-year schedule. [1] [2]

    Incentive failure
  2. 1997-08-23

    Launch

    Lewis launches from Vandenberg Air Force Base aboard an Athena I rocket and reaches its 300-kilometer parking orbit with nominal launch vehicle performance. [3]

  3. 1997-08-25

    Early anomalies and an uncontrolled attitude

    Twelve anomalies occur in the first four days on orbit. On August 25 a two-orbit loss of contact leaves the spacecraft found in an uncontrolled attitude with its battery partially discharged; the crew restores Safe Mode and stands down for the night without declaring an emergency. [4] [5]

    Technical failurePoor execution
  4. 1997-08-26

    The fatal flat spin

    A thruster imbalance spins the spacecraft around its unsensed intermediate axis, tripping automatic shutdowns on both thruster strings. The crew's recovery attempt only partially executes, and the spacecraft is never contacted again. [6]

    Technical failure
  5. 1997-09-28

    Reentry

    With no attitude control and a fully drained battery, Lewis reenters the atmosphere over the South Atlantic Ocean and is destroyed, thirty-six days after launch and without returning usable science data. [7]

  6. 1998-02-12

    Investigation board reports flawed design and thin oversight

    The NASA Mission Failure Investigation Board reports that a technically flawed Safe Mode design, combined with inadequate spacecraft monitoring, directly caused the loss, and that programmatic pressures under "faster, better, cheaper" indirectly enabled both. [8] [9] [10] [11]

    Technical failurePoor executionIncentive failure

Structured analysis

What Went Wrong

Root causes

A Safe Mode that could not sense its own spin. The attitude control system's Safe Mode pointed the spacecraft's intermediate, inherently unstable axis at the sun using a single two-axis gyroscope that could not measure rotation about that axis. The design was adapted from an earlier spacecraft whose safe mode pointed a different, stable axis at the sun, and the difference was not adequately re-analyzed for Lewis. [8]

Inadequate monitoring during the most vulnerable mission phase. TRW operated Lewis with a single ground-control crew and no overnight coverage during its first, most unstable days in orbit, and the operations team never declared a spacecraft emergency despite several unresolved anomalies, including a two-orbit loss of contact that left the spacecraft found in an uncontrolled attitude. [9]

Contributing factors

The Safe Mode was validated with an incomplete test. The simulation used to validate the Safe Mode never modeled a thruster imbalance or the spacecraft's actual transfer-orbit conditions, and the hardware-in-the-loop test that supposedly confirmed the simulation ran for only 100 minutes against the mode's 72-hour design requirement. [8]

Requirement changes made without added resources. NASA extended the spacecraft's required on-orbit life from three years to a five-year goal and changed launch vehicles mid-program, both adopted without a matching adjustment in program budget or schedule. [10]

The attitude-control team was physically split from the rest of the program. When TRW moved most of the Lewis program from Chantilly, Virginia to Redondo Beach, California, the attitude-control-system engineering and ground-operations teams were left behind, separated from the functional review structure the rest of the spacecraft's development enjoyed. [10]

Heavy turnover in TRW program leadership. The Lewis program had four different division managers and four different program managers within a fourteen-month period, each bringing a different management approach, which the investigation board linked to eroding engineering and management discipline as the program progressed. [10]

Single-shift ground operations adopted as a cost-saving measure. Facing cost pressure from NASA, TRW moved to a single-shift ground control crew even for the spacecraft's critical first 30 days in orbit, a decision senior NASA management did not learn about until after the spacecraft was lost. [9] [10]

Immediate trigger

A flat spin drained the battery beyond recovery. On August 26, 1997, a minor thruster imbalance spun the spacecraft up around its unsensed intermediate axis. The resulting excessive thruster firings tripped an automatic shutdown on both redundant thruster strings, leaving the spacecraft with no active attitude control, its solar arrays edge-on to the sun, and its battery draining with no way to stop it. [6]

Visible symptoms

Twelve anomalies in the first four days. Ground controllers logged roughly twelve anomalies in the spacecraft's first four days on orbit, including an unexplained autonomous switch to the backup processor and a solid-state recorder that would not play back launch data. [4]

Spacecraft found in an uncontrolled attitude with a partially discharged battery. After a two-orbit loss of contact on August 25, the spacecraft reappeared off-pointed from the sun by about 28 degrees with its battery at 43 percent depth of discharge, evidence it had gone largely uncharged during the outage. [5]

Warning signs

Three unresolved anomalies before the fatal spin. By the time of the catastrophic flat spin, the spacecraft had already produced three significant, unexplained anomalies in four days, none of which triggered a declared spacecraft emergency or additional ground-station coverage. [5]

A single-shift crew for a newly launched, uncharacterized spacecraft. TRW's decision to run Lewis's critical early operations with one ground crew per day, driven by cost pressure, was in place before launch and was not disclosed to senior NASA management until after the loss. [9]

Affected groups

Taxpayers

Keep reading

  • Mars Climate Orbiter

    A sibling "faster, better, cheaper" era NASA loss from the same period, destroyed by an unconverted-units navigation error rather than a spin-control flaw.

  • Mars Polar Lander

    Another "faster, better, cheaper" mission lost to an unvalidated safety mechanism behaving exactly as designed, in the wrong circumstances.

  • Mars Observer

    An earlier "faster, better, cheaper" era loss, on the way to Mars rather than in low Earth orbit, that helped push NASA toward the cheaper mission philosophy Lewis was itself flown under.

Evidence

Claims & sources

Every numbered marker in the analysis links to the claim it rests on, and each claim to its sources.

  1. [1]

    Lewis was developed under NASA's Small Spacecraft Technology Initiative, an experimental "faster, better, cheaper" program that gave contractor TRW broad engineering autonomy and minimal government oversight in exchange for speed and lower cost.

    High Fact Lewis Spacecraft Mission Failure Investigation Board Final Report Lewis (satellite) The Role of Small Satellites in NASA and NOAA Earth Observation Programs
  2. [2]

    NASA awarded the Lewis spacecraft contract to TRW on June 8, 1994 for $57,940,026, and a subsequent contract change in May 1996 established a cost cap of $64,800,000 for the whole program.

    High Fact Lewis Spacecraft Mission Failure Investigation Board Final Report
  3. [3]

    Lewis launched from Vandenberg Air Force Base on August 23, 1997 aboard an Athena I (Lockheed-Martin Launch Vehicle) rocket and reached its 300-kilometer parking orbit with nominal performance by the launch vehicle.

    High Fact Lewis Spacecraft Mission Failure Investigation Board Final Report Lewis (satellite)
  4. [4]

    Ground operations recorded approximately twelve anomalies in the first four days after launch, including an unexplained autonomous switch to the backup B-side processor and a solid-state recorder that would not play back launch-event data.

    High Fact Lewis Spacecraft Mission Failure Investigation Board Final Report
  5. [5]

    On August 25, 1997, ground stations lost contact with Lewis for two orbits; when contact was reestablished the spacecraft was found off-pointed from the sun by about 28 degrees with its battery at 43 percent depth of discharge, and after restoring Safe Mode the operations crew stood down for the night without declaring a spacecraft emergency.

    High Fact Lewis Spacecraft Mission Failure Investigation Board Final Report
  6. [6]

    On August 26, 1997, a thruster imbalance spun Lewis up around its intermediate axis, which its Safe Mode's single two-axis gyro could not sense, triggering automatic shutdown of both redundant thruster strings and leaving the spacecraft in an uncontrolled flat spin with its solar arrays edge-on to the sun; a recovery attempt during the final contact pass only partly executed because the crew addressed two of three thruster commands incorrectly, and contact was never reestablished.

    High Fact Lewis Spacecraft Mission Failure Investigation Board Final Report Lewis (satellite) Lewis spacecraft failure board report released
  7. [7]

    With no attitude control and a drained battery, Lewis reentered the atmosphere over the South Atlantic Ocean and was destroyed on September 28, 1997, without ever returning usable science data.

    High Fact Lewis Spacecraft Mission Failure Investigation Board Final Report Lewis (satellite) Lewis spacecraft failure board report released
  8. [8]

    The Mission Failure Investigation Board found the direct cause of the loss was a technically flawed Safe Mode design, adapted from an earlier spacecraft's attitude control system without adequately modifying it for Lewis's different, unstable spin-axis orientation, and validated only by a simulation and a 100-minute hardware test that never modeled a thruster imbalance despite the mode's 72-hour design requirement.

    High Reported explanation Lewis Spacecraft Mission Failure Investigation Board Final Report Lewis (satellite) The Role of Small Satellites in NASA and NOAA Earth Observation Programs
  9. [9]

    The board found inadequate spacecraft monitoring was a co-equal direct cause of the loss, driven by TRW's decision to run single-shift ground operations as a cost-saving measure during the spacecraft's critical first 30 days, a decision senior NASA management did not know about until after the failure, and by the operations team's repeated failure to declare a spacecraft emergency despite several unresolved anomalies.

    High Reported explanation Lewis Spacecraft Mission Failure Investigation Board Final Report
  10. [10]

    The board identified indirect, programmatic contributors to the failure, including a NASA-directed extension of the required on-orbit life from three to five years and a launch-vehicle change made without added resources, cost and schedule pressure, the physical separation of the attitude-control team from the rest of the program after TRW's move to Redondo Beach, and turnover of four division managers and four program managers within fourteen months.

    Moderate Reported explanation Lewis Spacecraft Mission Failure Investigation Board Final Report
  11. [11]

    The investigation board endorsed the "faster, better, cheaper" philosophy in principle but concluded that NASA and TRW had never reached a shared, working understanding of the changed roles and reduced government oversight the approach required, and recommended clearer roles, formal risk management, and independent technical review for future programs run this way.

    Moderate Analysis Lewis Spacecraft Mission Failure Investigation Board Final Report The Role of Small Satellites in NASA and NOAA Earth Observation Programs

Sources