Software error caused Schiaparelli crash


Please consider donating to Behind the Black, by giving either a one-time contribution or a regular subscription, as outlined in the tip jar to the right. Your support will allow me to continue covering science and culture as I have for the past twenty years, independent and free from any outside influence.

A new ESA report says that the ExoMars 2016 Schiaparelli lander failed because its navigation system thought the lander was on the ground when it was still more than two miles from the surface.

Europe’s Schiaparelli Mars lander crashed last month after a sensor failure caused it to cast away its parachute and turn off braking thrusters more than two miles (3.7 km) above the surface of the planet, as if it had already landed, a report released on Wednesday said.

Figuring out what caused this failure will be helpful for the design of the ExoMars 2020 rover, but the failure here is likely going to make it more difficult for Europe to raise the money needed for that next mission, including a 400 million euro cost overrun.

Share

11 comments

  • wodun

    SpaceX has a leg up on them.

  • LocalFluff

    I read (speculations?) that the inertia senor gave negative values when the engines started, indicating that it was moving upwards. Good software should not accept that as a fact since it is physically impossible. It did take photos on the way down and it could’ve been possible to use live autonomous analysis of them as backup indication of its speed.

    The Hitomi X-ray space telescope, a JAXA/NASA cooperation, earlier this year had an inertia sensor indicating that it was spinning shortly after launch. Reaction wheels were autonomously activated to despin it (it was not yet under ground control). But the sensor didn’t change its indication so the wheels continued. As a matter of fact the sensor was broken so the despinning actually *started* to spin it from a good status, and accelerated the spin until centrifugal forces tore it apart. Ground radar observed it breaking up into 5 or so large pieces as the deployed delicate solar panels were torn off of it. I think that the code should’ve realized that if the wheels don’t stop the spin, something is wrong. Either the wheels or the inertia sensor, and that one better stop doing more of what doesn’t work. Using other sensors or actions or waiting for manual commands from Earth.

    Calibration of inertia sensors are sensitive to the violently shaking launch. As far as these stories are true, I’m amazed that inertia sensors are still single points of failure. They have failed before. The Proton-M/Glonass that crashed spectacularly near its launch pad in 2013 did so because all of its gyroscopes had been assembled upside down. They had a checkout procedure (I think maybe while they raise the launcher to vertical?) but that only validated the gyroscopes against each other, and all of them had the same error, so it was automatically cleared as good. Why was it even possible to mount them upside down?

    @wodun SpaceX has never sent anything to Mars. The science payload, the ExoMars orbiter, was successfully inserted in Mars orbit. Schiaparelli was just a tech demo. They may have learned more from its failure than from a lucky but irrepeatable success.

  • LocalFluff

    I think autonomous spacecrafts need another philosophy for situational awareness. This has been mentioned in the general debate in connection with military space defense. But I think it would have great benefits for spaceflight in general too.

  • fred

    Very good description from LocalFluff — it is amazing that a system that expensive can be that brittle.

  • wodun

    SpaceX hasn’t been to Mars but their landing systems have undergone repeated testing. They might have some other kind of failure but probably not the one that Schiaparelli did.

    There are some big advantages to running a business and iterating technologies over government run programs that fly/land infrequently.

  • Edward

    LocalFluff wrote: “I think that the code should’ve realized …

    Ah, the problem of error detection in software. I suspect a few possible reasons why they didn’t do this:

    1) Lack of imagination of what could go wrong.
    2) Lack of computer capacity to program for the impossible events (e.g. moving upwards before thruster ignition).
    3) Lack of resources to program for the impossible events (e.g. manpower or schedule time).

    My understanding is that the gyroscopic sensors aboard the Proton that failed so spectacularly (even more so in slow motion: https://www.youtube.com/watch?v=vqW0LEcTAYg ) had “this end up” type of arrows indicating proper orientation, but no form of keying to guarantee proper installation. Another failure to imagine a possible human error.

    On my first-ever job, someone wrote a procedure that was foolproof. Unfortunately, I was still able to screw up the process, and it was declared that while the procedure was foolproof, it was not idiot-proof. We humans learn the hard way, and often from humiliating mistakes. Like installing sensors upside down or having software that thinks a descending lander is already on the ground.

    LocalFluff wrote: “Calibration of inertia sensors are sensitive to the violently shaking launch.

    Back when I was building satellites, people could physically work on the satellite while most electrical testing occurred, but I had to send my technicians away from the satellite whenever the electrical crew was calibrating an Inertial Measurement Unit. The vibrations from just working around the satellite is significantly less violent than during launch but was enough to mess up calibration.

    LocalFluff wrote: “I think autonomous spacecrafts need another philosophy for situational awareness.

    With Google, Tesla, and others working on autonomous automobiles, I suspect that a lot of learning is happening now and is going to happen in spades once these vehicles are released widely to the public. Lessons in this area may help accelerate improvements in other autonomous situations, such as rockets and spacecraft.

    As a for-instance: a few months ago, a Google autonomous vehicle had a collision with a bus, because the vehicle’s software was expecting a different behavior from the bus. The software needed a change to better handle the unexpected, and now depends less on anticipated traffic behavior.

    http://www.theverge.com/2016/2/29/11134344/google-self-driving-car-crash-report
    several weeks ago we began giving the self-driving car the capabilities it needs to do what human drivers do: hug the rightmost side of the lane. This is the social norm because a turning vehicle often has to pause and wait for pedestrians; hugging the curb allows other drivers to continue on their way by passing on the left. It’s vital for us to develop advanced skills that respect not just the letter of the traffic code but the spirit of the road. … From now on, our cars will more deeply understand that buses (and other large vehicles) are less likely to yield to us than other types of vehicles, and we hope to handle situations like this more gracefully in the future.

    Which seems to make wodun’s point: “There are some big advantages to running a business and iterating technologies over government run programs that fly/land infrequently.

  • Localfluff

    Esward, That’s a really good point about Tesla and Google and new autonomous technology. Elon Musk doesn’t do any business investment that isn’t useful for his Mars dream.

  • Edward

    Localfluff, “Elon Musk doesn’t do any business investment that isn’t useful for his Mars dream.

    I never thought of Musk’s investment in Tesla in that way, before.

    Interestingly, the three people who seem to be doing best in the NewSpace business did not get there through the aerospace industry. Musk started PayPal to earn the money that he used to start SpaceX. Bezos earned his money with Amazon, and started Blue Origin. And Bigelow earned his money in real estate.

  • wayne

    Edward/LocalFluff–
    The Fluff-Man has it nailed.
    The WSJ covers Musk quite a bit– they have opined numerous times that Tesla is a testing bed for control-type software & autonomous vehicle’s (on earth & o/w) , which feeds into the rockets & Mars, and Solar-City technology is focused on electricity generation/collection/storage, which also feeds into rockets & Mars.
    I would tend to agree he has multiple reasons for doing all his stuff & there is a method to his actions.

    Tangentially– I just discovered Dr. Spudis & his “Value of the Moon,” idea— totally on board with colonizing the moon, first.
    (We need to be designing water-ice harvesting infra-structure.)
    Musk can go to Mars if he can pull it off, and more power to him for all the rocket technology he’s developed, but… Mars is a bridge too far, if we want to actually colonize Space.
    But, as Edward noted in part– he loves Mars, and for him, All Roads Lead to Mars.

  • LocalFluff

    A well known blog-neighbor found me this little dispute about why Schiaparelli failed (oh, the blessings of international cooperations for space flight!):
    http://www.parabolicarc.com/2016/11/28/arca-space-blame-failure-esas-exomars-lander/
    http://www.romaniajournal.ro/esa-releases-preliminary-results-in-exomars-schiaparelli-crash-landing-after-italy-accused-romanian-corporation/
    ESA released the preliminary conclusions after the Italian Space Agency had accused that the decisive tests for the Sciaparelli[sic] lander simulations had been entrusted to an organization “which hadn’t enough expertize[sic]”. It’s about Arca Space Romanian company

    ”to run a specific test we should have flown very closely to the Russian base in Sevastopol. Russia has just annexed Crimea and we risked generating a conflict between the Russian Federation and NATO,” the Romanian [ESA member] manager argued.

  • LocalFluff

    Edward, And even the Hyperloop thing, which is madness on Earth, is an attempt of Elon Musk to get public financing for developing Mars-technologies. Vacuum engineering for one thing. And with that fan to work like a propeller inside of near vacuum, which is ridiculous, is just a way to lure investment into flying rotating wing in Mars atmosphere, which is possible, barely. Some very low weight prototype has been tested in Mars vacuum in laboratories.

    I predict that Elon Musk will somehow soon get into the bio-industry too, again by using the climate panic and the overpopulation myths in order to mobilize more monies from tax payers in the direction of Mars. Whatever piece is missing in his mission to Mars puzzle, he will go for next. Maybe instead nuclear power in space will be his next priority, if the climate panic isn’t politically correct anymore.

    Ultimately, once on Mars, he might found PayPal2 in order to own all the monies in his colony ;-)

    Jeff Bezos of Blue Origin seems to have a problem with Trump, because of his unfortunate news paper business.

Leave a Reply

Your email address will not be published. Required fields are marked *