The Quaternion Is Right. You're Reading It Backwards.
A guidance computer can receive a valid attitude quaternion, correctly typed, in range, and delivered on time, and still fly the vehicle into the ground. Four good numbers arrive. The receiver reads them as a rotation in the opposite direction the sender meant, or with the scalar term on the wrong end, and every calculation downstream is confidently wrong. The interface control document named the field and never named the convention.
In September 2004 a capsule a meter and a half across fell over the Utah desert at roughly 310 kilometers an hour and buried itself in the ground at Dugway Proving Ground. Genesis had spent three years collecting solar wind for return to Earth. Its parachutes never fired. The deceleration sensors that were meant to feel reentry and trigger the drogue had been built to a design drawing that showed them inverted, so the switch that should have closed under braking sat backward and never closed at all. The sensors worked. They were pointed the wrong way, and no review caught the sign.
A value has a frame, and the frame is not in the file
Genesis was a hardware orientation error, a part installed to a drawing that had the arrow reversed. The software version of the same mistake ships on programs every year, and it is harder to see because nothing is physically backward. A vector or a rotation carries no meaning on its own. It means something only against a reference the two sides have to share: which frame it is expressed in, which way the rotation turns, where zero sits, what instant it is timestamped against.
Open an ICD and you will find the field defined to the bit. "Attitude quaternion, four by float64." What you will not find is the half-dozen conventions that decide what those four numbers mean. Is the scalar term first or last? Does the quaternion rotate the body frame into the inertial frame, or the inertial into the body, the two related by a conjugate and each a valid unit quaternion? Is a position in Earth-centered inertial or Earth-centered Earth-fixed coordinates, which drift apart by a full rotation a day? Is latitude geodetic or geocentric? Is the timestamp GPS time or UTC, which as of today sit eighteen leap seconds apart? Every one of those is a real choice, and the document usually leaves it to prose or to nothing.
Both sides pass review and still disagree
The reason this survives design review is that both engineers read the same sentence and fill the gap from their own house style. A navigation team living in the SPICE toolkit writes quaternions scalar-first, because that is how SPICE has always done it. A software team building the flight code in ROS or Eigen writes them scalar-last, because that is what those libraries expect. Both teams conform to "quaternion, four by float64." Both pass their own unit tests. Neither is wrong inside its own house. The interface between them is where the disagreement lives, and the interface is exactly the thing no one owns.
Rotation direction is worse, because it leaves no fingerprint. Swap scalar-first for scalar-last and a sharp reviewer might notice the numbers look shuffled. Invert the rotation sense and the quaternion still has unit norm, still looks like a perfectly ordinary attitude, and points the vehicle the other way. There is no field to inspect. The convention was never a value; it was an assumption, and the two boxes assumed opposite things.
The check that would catch it does not exist
This is the class of bug that field-level verification cannot touch. The checksum passes. The range check passes, because a backward rotation is a valid rotation. The units are right, the scale is right, the update rate is right. Everything a test can read off the message is correct. The error is in what the number is understood to mean, and meaning is the one attribute an ICD records in sentences a compiler never sees.
A quaternion is four numbers and two arguments: which way the rotation turns, and which end the scalar sits on. The ICD usually settles neither.
So the mismatch waits. It clears every bench test that exercises one box at a time, because inside one box the convention is self-consistent. It surfaces the first time the two boxes have to agree on where the vehicle is pointing, which is integration if you are lucky and flight if you are not. By then the fix is not a line of code. It is a schedule.
Put the convention in the type, not the prose
We have argued before that the interface belongs in code, with the document generated from it rather than written beside it. Convention is the clearest case for it. Prose cannot stop a scalar-last library from reading a scalar-first message, but a type can. If the schema that defines the message also declares its frame, its rotation sense, its scalar position, and its time system, those become properties the build enforces and the simulation exercises. A rotation from the body frame to the inertial frame is then a different type from its inverse, and code that mixes them fails to compile instead of failing to land.
None of this needs a new standard. The vocabulary already exists and the disciplined corners of the field already use it. SPICE refuses to transform a vector until you name the frame it started in and the frame you want, "J2000" or "IAU_MARS," on every call. Geodesy pins coordinate systems to EPSG codes so that "latitude" is never ambiguous. Aviation standardized on WGS84 so a position from one system means the same thing in another. What most space programs lack is the habit of treating the coordinate frame and the sign convention as part of the interface definition, with the same weight as the field width, instead of a footnote two engineers were each sure they had read the same way.
A software-in-the-loop run that carries the convention can swap a frame on purpose and watch the vehicle command the wrong correction on a Tuesday, months before hardware exists. A run that carries only the numbers shows green through the exact scenario that loses the vehicle, because the numbers were never the problem. The value will keep arriving valid, in range, on time, and meaning the opposite of what the other box assumes, until the convention is written into the interface as precisely as the four bytes that carry it.
