29/05/2017

Schiaparelli EDM module failure report released


The investigations of the ExoMars 2016’s Schiaparelli Entry Descent and Landing demonstrator module (EDM) have concluded, and a detailed report has been released by the Schiaparelli Inquiry Board (SIB), a pool of independent experts which was requested to elaborate it. The SIB, chaired by the ESA Inspector General Toni Tolker-Nielsen, has gone into depth in the sequence of errors which led to the crash of the module, has identify their causes, and has recommended the convenient corrective actions to be taken into account with regard to ExoMars 2020 mission.


Image of Schiaparelli impact point taken by Mars Reconnaissance Orbiter.
Credit: NASA/JPL-Caltech/University of Arizona.

Schiaparelli EDM was a module intended to test the technology to be used in the landing of the ExoMars 2020 mission. Its failure cast doubts on the capability to successfully deposit on the surface of Mars the rover and the Surface Platform (this latter mounting HABIT instrument), the mission is composed of, and hence, the crash could have meant the cancellation of the programme depending on the magnitude of the problems which caused it. Yet, Schiaparelli EDM was a “demonstrator”, that is to say, a trial, and the appearance of faults was a possible outcome.
Since the first moment, the representatives of ESA were optimistic about the consequences of the failure: EDM completed correctly the entry stage, and the descent one was “nominal” (as expected) until its last phase, losing the communication with it only when the module hit the ground. All the telemetry data until the very moment of the crash were registered and transmitted, so the full reconstruction of the events could be possible, allowing the identification of the problem and its appropriate solution.
ExoMars 2020 was not threatened at first, though a thorough investigation had to be performed. It was assigned to an external and independent group of experts, the aforementioned SIB, which released its report, “Schiaparelli Anomaly Inquiry” last 18th of May. The availability of data has permitted to figure out an accurate depiction of the root cause of the failure and the cascade of errors it led to.
It seems it all started when the parachute was deployed. The modelling of the parachuting effects at the speed of the spacecraft after the initial aerobraking against the Martian atmosphere (Mach 2), is subjected to many uncertainties given the number of uncontrollable factors playing a role in the process. In this case, unexpected (but not unforeseeable) angular motions were generated during the parachute deployment and inflation causing, in a second stage, the saturation of the Inertial Measurement Unit (IMU), a device whose function is to provide information about the movement state of the spacecraft, including speed, angular rate, attitude etc. as a result of the non-gravitational accelerations acting on it. This saturation last for an unexpected lapse of time leading to an error in the attitude estimation by the Guidance Navigation and Control (GNC) unit, which in turns caused a wrong measurement of the altitude by the Radar Doppler Altimeter (RDA).
Indeed, the final and fatal reading of the altitude resulted to be negative (as if the spacecraft was actually under the ground, an unacceptable result which should have been managed through an appropriate checking procedure), so the parachute was detached prematurely and the retrorockets were ignited and switched off three seconds after, when the module was at some 3.7 kilometres above the surface. It initiated a free falling to eventually crash on the ground at an estimated speed of 150 m/s (540 km/h).
According to the SIB’s report, the key factor was the duration of the saturation persistence of the IMU. It was accepted to be of 15 ms but it was not, and this feature was not appropriately checked when the hardware was delivered by the correspondent subcontractor. However, this factor is linked to an inadequate modelling of the parachute deployment and inflation process, which did not take into account “worst case” simulations.

Artistic illustration of the retro-propelled descent phase of Schiaparelli EDM.
Credit: ESA.

A deficient management by the GNC of the information from the IMU and the RDA has also been appreciated, together with a malfunction of the Failure, Detection, Isolation and Recovery (FDIR) unit. If these elements had worked adequately, the accident could have been avoided despite the initial error from the IMU saturation.
On the other hand, the accident entailed the lack of demonstration of the retrorocket phase, so especial attention should be dedicated to this particular matter.
The good news is that every detail of the event has been cleared out, and the way to proceed from now on has been well defined. The solutions regarding the landing of ExoMars 2020 are relatively simple and easy to implement, so the launch of the mission, which is of “paramount importance to the European exploration programme” is not compromised. The SIB lists a series of specific recommendations regarding different aspects of the development of a space exploration project, from technical ones to those related to the management, the funding, or the timing of the works; in this sense, the report points to certain tests which should have been performed and were cancelled due to shortcuts, in the basis of some of the appreciated deficiencies which eventually led to the failure.