Faulty Software becomes prime Suspect in botched Schiaparelli Mars Landing

A navigation software miscommunication appears to have played a central role in last week’s Schiaparelli crash landing on the surface of Mars, initial analysis of data recorded during the lander’s descent reveals.

Schiaparelli – part of the European Space Agency’s ExoMars 2016 mission – was attempting to demonstrate Mars entry & landing technology for the ExoMars 2020 mission that aims to deliver a much larger payload to the surface of the planet comprised of a European rover and Russian-built surface platform.

The 600-Kilogram lander was dispatched on its final descent toward Mars by the main element of the mission, the Trace Gas Orbiter which – in parallel to Schiaparelli’s landing – fired its main engine to be captured in Mars orbit for a five-year mission exploring the planet’s atmosphere. Schiaparelli hit the atmosphere at 14:42 UTC last Wednesday and was set for a six-minute descent to the surface, but signals from the lander stopped around a minute prior to the expected landing.

Firm evidence of the lander’s demise came last Friday in the form of images taken by the Mars Reconnaissance Orbiter’s Context Camera showing a dark patch around 15 by 40 meters in size where the lander crashed and likely exploded upon impact. When the photos arrived on Earth, specialists at ESA were already sifting through data to reconstruct what happened to the lander – beginning to solve a case that will keep them busy for months to come.

While descending through the thin Martian atmosphere, Schiaparelli transmitted some 600 Megabytes of data recorded by the Trace Gas Orbiter and sent back to Earth for analysis.

The data quickly revealed that Schiaparelli enjoyed a normal entry, hitting the atmosphere 121.5 Kilometers in altitude at a speed of 5.83 Kilometers per second. Slowing down, Schiaparelli was to deploy its parachute at a speed of Mach 1.95, going almost twice the speed of sound. Parachute deployment and the jettisoning of the heat shield to expose the lander’s radar altimeter were also as expected according to teams at the European Space Operations Center.

Where Schiaparelli ran into trouble was the separation of the Surface Platform from the back shell that was expected to occur between 600 and 1,250 meters in altitude at a speed of 60 to 85 meters per second – to be followed by a thirty-second rocket-powered descent to deliver Schiaparelli to a point two meters above the surface for a short free fall to the ground.

According to data from Schiaparelli, the surface platform cut itself loose four minutes and 41 seconds after the onset of re-entry – 41 seconds before the planned time. The nine rocket engines that were to slow Schiaparelli for landing ignited after separation from the chute but only fired for three seconds, before shutting down and leaving the lander plummeting to the surface.

ESA believes Schiaparelli fell from an altitude of two to four Kilometers and impacted at a speed of over 300 Kilometers per hour.

Working out exactly why the lander detached itself prematurely and only fired the engines for three seconds will be the major objective of Schiaparelli’s post-mortem.

Preliminary insights shared by ESOC Director of Mission Operations Rolf Densing in an interview with Deutschlandfunk point to a software problem.

According to Densing, two different pieces of software – one running the Radar Doppler Altimeter and the other in charge of general navigation – did not communicate correctly. This led to a timeout causing the lander to cut itself loose from the chute and, after only three seconds of powered descent, to switch to landed mode, thinking it was already sitting on the surface. While free falling, Schiaparelli even powered up its surface instruments, but no meaningful data was gathered.

Schiaparelli’s navigation system utilized three major components – a pair of sun sensors, two Inertial Measurement Units**, and a purpose-built Radar Doppler Altimeter.

The two sun sensors were used immediately after activation of the lander at Entry -75 minutes in order to determine the vehicle’s attitude and re-build an inertial reference frame which could be integrated with IMU Data during the entry phase. This process was to be complete by 15 minutes ahead of entry and the twin IMUs were then the primary instrument to detect an acceleration threshold to guarantee the chute is deployed in the correct envelope of Mach-Dynamic Pressure conditions.

This all appeared to work properly until the radar came into the mix, being powered up ten seconds after the jettisoning of the heat shield. Acquisition of the ground was expected 17 seconds after activation followed by radar data validation comparing the radar with the current altitude/velocity obtained by integrating the initial reference frame with IMU measurements made throughout entry.

Radar validation was expected to finish around two Kilometers in altitude at which point radar data was to be fed into the general navigation algorithm for the computation of Surface Platform Separation triggering between 1.4 and 1.0 Kilometers in altitude.

The timing of the premature surface platform separation (~40 seconds after heat shield jettison) and the altitude given by ESA (2-4km) suggest trouble arose at some point in the Radar Doppler Altimeter Acquisition and Validation Sequence. At this point, RDA data was not to be processed as part of closed loop navigation and should not have been able to influence flight events.

How a timeout on the radar side commanded a separation of the lander before closed loop navigation was planned to start will be a central question to answer. Even more puzzling is Schiaparelli switching to ‘landed mode’ when the Inertial Measurement Units were still showing it in a fast decent.

Engineers will be employing a Schiaparelli mission simulator to replicate the failure signature and understand how and why merging of the radar and general navigation software did not work as expected and why the computer responded the way it did.

A complete understanding of the fault will be necessary before committing the ExoMars 2020 mission to flight. The rover & surface platform will utilize a combination of European and Russian technology, but the sensor and software package used in the landing maneuver will be similar to Schiaparelli’s system with a radar playing an integral part in the descent.

Working out a purely software-related issue in time for the 2020 mission will be a simpler affair than re-working the landing hardware, though teams have their work cut out to precisely understand the failure mode that transpired last week and identify any other deficiencies that could lead to similar results.

ESA continues to stress that all possible scenarios are being considered and information provided so far has to be considered preliminary. A report of the first definitive findings of the investigation will come forward around mid November.

The ExoMars 2020 mission still has a budget shortfall of €300 million which ESA plans to request from its member states in a Ministerial Meeting held in December. Top officials did not express any worry Schiaparelli’s failure could put funding in jeopardy because critical Entry, Descent & Landing data to refine the 2020 mission was collected and is available to engineers, though showing off a successful landing would have certainly created a more convincing case.

New photos from the Mars Reconnaissance Orbiter’s High Resolution Imaging Science Experiment (HiRISE) were released on Thursday providing a high-resolution look at the major components of the Schiaparelli lander.

The Surface Platform itself created a crater around 50 centimeters deep around which asymmetric dark markings can be seen, likely representing debris and soil ejected when the lander’s Hydrazine tanks exploded. Another interesting feature is a long dark arc seen in the upper right of the dark patch – no explanation has been found for its origin yet.

HiRISE also imaged the backshell and parachute located 1.4 Kilometers south of the surface platform and the forward heat shield resting 1.4km east of the lander’s impact site.

More images will be collected in the weeks to come under different lighting conditions to help in identifying some of the features seen in the initial photos.

**An earlier version of this article incorrectly identified the IMU used on the Schiaparelli lander and has since been corrected to reflect accurate information.