A Crazy Miscalculation Doomed the Schiaparelli Lander

Schiaparelli’s heat-scorched shield. (Credit: ESA/ATG Medialab)
Schiaparelli’s heat-scorched shield. (Credit: ESA/ATG Medialab)

The European Space Agency has released new information about the crash of the ExoMars Schiaparelli lander. Soon after the deployment of its parachute, the lander made a miscalculation so bad that it thought it was below the Martian surface, when in reality was still two miles high.

Advertisement

The ESA’s investigation into the crash is far from over, but this latest revelation is painting a clearer picture of what happened during the failed landing on October 19.

Schiaparelli deployed its parachute normally at an altitude of 7.5 miles (12 km) and at a speed of 1,075 miles per hour (1,730 km/h). As planned, the vehicle’s heat shield was ejected when it reached an altitude of 4.85 miles (7.8 km). But things went to complete shit from there.

Advertisement

As it was making its slow descent, Schiaparelli’s Inertial Measurement Unit (IMU) went about its business of calculating the lander’s rotation rate. For some reason, the IMU calculated a saturation-maximum period that persisted for one second longer than what would normally be expected at this stage. When the IMU sent this bogus information to the craft’s navigation system, it calculated a negative altitude. In other words, it thought the lander was below ground level. Ouch.

High-resolution images of the crash site. (Image: Copyright NASA/JPL-Caltech/University of Arizona)
High-resolution images of the crash site. (Image: Copyright NASA/JPL-Caltech/University of Arizona)

That fateful miscalculation set off a cascade of despair, triggering the premature release of the parachute and the backshell, a brief firing of the braking thrusters, and activation of the on-ground systems as if Schiaparelli had already reached the surface. This all happened while the vehicle was still two miles (3.7 km) above ground, causing a catastrophic free fall that sent the lander plummeting downward at 185 mph (300 km/h).

Encouragingly, this behavior was replicated in computer simulations, which means mission planners stand a good chance of correcting the anomaly. The exact cause of the IMU’s miscalculation was not disclosed, but if it was tripped by some kind of mechanical problem, that would be bad news. The ESA is planning a similar mission in 2020, which doesn’t leave much time for an engineering overhaul. A software glitch, on the other hand, would likely prove to be an easier fix. A full report of the investigation is expected in early 2017.

Advertisement

[ESA]

George is a senior staff reporter at Gizmodo.

Share This Story

Get our newsletter

DISCUSSION

This keeps happening to ESA because they are bad at test driven development and simulating what is going to happen with a backup unit. NASA does this stuff - and things still go wrong, you can’t think of everything. But at least tests with the backup unit flag some of the things you didn’t think of. ESA only seems to take this seriously after things go terribly wrong.

And they’re insufficiently paranoid. It might have been caused by a hardware failure, but the firmware shouldn’t believe everything it ‘hears’ instantly. You need multiple sources confirming anything critical and they need to hold glitch free for some period. I can’t say I’ve ever written firmware for a planetary lander, but I certainly write it for big things that can go horribly, expensively, and sometimes dangerously wrong, and after a while you get really good at thinking of all the things that might go wrong, even if they ‘can’t’ and putting sanity checks in. I fake bad and garbage inputs (those are different) to see what happens.

Like Beagle II - according to recent paper that actually landed, but couldn’t communicate because only 3 of the 4 solar panels had opened. You should not have to rely on six major mechanical things all going right for communications to work. If it had been able to communicate with 3 of the 4 panels open the project would still have been a major success instead of an abject failure.