Schiaparelli EDM

ESA · Europe · Lander · 2016 · The long occupationFailure

Destroyed on impact in Meridiani Planum on 19 October 2016 at 14:47:28 UTC, 37 seconds early, at about 150 m/s. ESA's inquiry board reported on 17 April 2017 and ESA announced the findings on 24 May 2017.

TL;DR· 15 min read

Schiaparelli was a 577 kg demonstrator flown to prove Europe could land on Mars, and almost everything worked: heat shield, parachute, radar, thrusters. But for about a second its inertial unit reported a rotation faster than it could measure; the software took that saturated rate as real, leaving the attitude estimate about 165 degrees wrong and the radar ranges reading as a negative altitude. Believing it had landed, the computer cut the thrusters after three seconds and the module fell 3.7 km, hitting at about 150 m/s on 19 October 2016.

Schiaparelli was not really trying to do science. It was a 577 kg entry, descent and landing demonstrator, sent to prove that Europe could put something down softly on Mars before it tried it with a rover. Almost all of it worked. The heat shield worked, the parachute worked, the radar altimeter worked, the thrusters lit. What failed was a single number in the guidance software: for about a second the inertial measurement unit reported that it was spinning faster than it could measure, the software integrated that saturated rate as if it were real, and Schiaparelli's computer concluded it was underground.

of thruster firing instead of 30, because the computer thought it had already landed: 3 sof thruster firing instead of 30, because the computer thought it had already landed
attitude error built up while the saturation flag stayed set: 165 degattitude error built up while the saturation flag stayed set
altitude of the free fall that followed, ending at about 150 m/s: 3.7 kmaltitude of the free fall that followed, ending at about 150 m/s

HiRISE view taken on 25 October 2016, six days after the crash, of the ground in Meridiani Planum where Schiaparelli came down, with magnified insets of three places where parts of the spacecraft reached the surface: the lander module's dark impact scar, the parachute with the back shell, and the front heat shield. — Six days after the crash: HiRISE picks out the impact scar, the parachute with its back shell, and the heat shield. NASA/JPL-Caltech/Univ. of Arizona

Commonly wrong. (1) The most common version of this story says the parachute failed. It did not. The parachute deployed on schedule at Mach 2.05, inflated in about a second, and slowed the module as designed; the inquiry's own conclusion lists parachute deployment and inflation among the things that worked. (2) Another version says the IMU failed. It did not: the board tested the unit under high angular acceleration and jerk, found it performed nominally, and concluded the rates it reported were real, produced by canopy area oscillation that the pre-flight parachute model did not include at all. (3) Some accounts call it a software bug in the sense of Mars Climate Orbiter's units mismatch. The flight software performed as specified. What was wrong was a parameter, the persistence time of the IMU's saturation flag, which was never measured at acceptance and was believed to be 15 milliseconds, together with a failure logic that could only imagine radar faults. There is a real sign error in the story, propagated from an incomplete requirement into the guidance software, but post-flight testing showed it made no difference. (4) The impact speed is often quoted from the first week: ESA said more than 300 km/h on 21 October 2016 and HiRISE said more than 83 m/s on 27 October. Those were preliminary. The reconstructed figure is about 150 m/s, roughly 540 km/h, from a free fall starting at 3.7 km rather than the 2 to 4 km first estimated.

Schiaparelli existed to answer an engineering question rather than a scientific one. Europe had never landed anything on Mars that worked. Beagle 2 had reached the surface in 2003 and never called home. The ExoMars programme intended to put a drilling rover down in the early 2020s, and before committing to that, ESA wanted to fly the entry, descent and landing chain once for real. So a 577 kg module built in Italy by Thales Alenia Space rode to Mars bolted to the Trace Gas Orbiter, launched on a Proton-M from Baikonur on 14 March 2016. Its aeroshape was inherited from NASA practice: a 70 degree sphere-cone front shield 2.4 m across, a 47 degree conical back shell, Norcoat-Liege ablator on both. A 12 m disk-gap-band parachute would come out of a mortar at supersonic speed. Nine hydrazine thrusters in three clusters would take it from about 1.3 km down to two metres, then cut out and let a crushable base absorb the last short drop. Its avionics were single-string with no failure tolerance, a decision the inquiry later attributed to a programme run under constant financial pressure and a fixed launch window. Schiaparelli separated from TGO on 16 October 2016 at 14:42:00 UTC and coasted for three days. It carried a modest instrument set, and its most valuable payload was arguably the telemetry stream itself.

It woke at 13:29:48 UTC on 19 October and hit the atmosphere seventy-two minutes later, entry registering on the accelerometers at 14:42:22, at the 122.5 km and roughly 21,000 km per hour ESA had predicted. Everything worked. The heat shield did its job, and sensors on both the front and back shields collected data that ESA says had never before been obtained from the back shield of a vehicle entering the Martian atmosphere. At 14:45:23 the g-level trigger fired the parachute mortar at 12 km altitude and 1,730 km/h, an estimated Mach 2.05, inside the pre-flight predicted range. The canopy inflated in about a second, exactly as modelled. Then, roughly two tenths of a second after the peak inflation load, the module began oscillating at around 2.5 Hz and its inertial measurement unit reported a pitch rate higher than it could measure. It raised a saturation flag, which is the correct behaviour for an instrument being asked for a number it does not have. The guidance software's response was the problem. For as long as the flag stayed set, it integrated a constant rate equal to the saturation threshold, as though the vehicle were spinning steadily at the limit rather than swinging back and forth. By the time the flag cleared, the estimated attitude was wrong by about 165 degrees.

That error was harmless for nearly a minute, because nothing on board yet depended on attitude. The front shield came off on a timer at 14:46:03 and the Radar Doppler Altimeter switched on at 14:46:19. The radar was fine. It returned coherent slant ranges to the ground. But a slant range only becomes an altitude when you project it onto the vertical using your attitude estimate, and projecting through an angle greater than ninety degrees gives a negative cosine. The computer concluded it was below ground level. Nothing on board checked whether that was possible, even though the radar was plainly receiving echoes off the surface. The onboard logic did notice that the radar and inertial data disagreed, but the failure-handling design assumed such a disagreement could only mean a radar problem, and since landing without the radar was impossible, after five seconds it forced the radar in and left the attitude estimate unchallenged. At 14:46:46 the software entered terminal descent, where altitude triggers everything. Back shell and parachute separated at 14:46:49. The thrusters lit at 14:46:51 and shut down at 14:46:54, because the shutdown criterion compares estimated energy to a threshold and a large negative altitude makes that condition true immediately. Three seconds instead of about thirty. Then the module switched to surface mode, at 3.7 km.

The free fall lasted about 34 seconds. The signal stopped at 14:47:22 and Schiaparelli hit at 14:47:28 at roughly 150 m/s, some 37 seconds before it was due to land. The inquiry board, chaired by ESA's Inspector General Toni Tolker-Nielsen with members from CNES, DLR, NASA/JPL, three retired ESA managers and three universities, named four root causes: parachute dynamics modelled without enough conservatism, an inadequate saturation-flag persistence time combined with inadequate handling of saturation in the guidance software, an insufficient approach to failure detection and design robustness, and a mishap in subcontractor management and hardware acceptance. That last one is the sharp end. The persistence time of the saturation flag was never measured at acceptance and was simply believed to be 15 milliseconds. The report states plainly that at 15 ms the landing would probably have succeeded. It also records that the flight software performed as specified, including faithfully propagating a sign error inherited from an incomplete requirement, and that post-flight testing showed the sign error was irrelevant: what mattered was duration. Direction made no difference. The board issued 16 recommendations, including the almost plaintive suggestion that on-board software should check that altitude cannot be negative.

MRO found the wreck the next day: a dark patch about 15 by 40 metres, with the parachute a kilometre south. By 25 October HiRISE had resolved a 2.4 m dark spot where an object of roughly 300 kg (the inquiry gives 280 kg at landing) had hit dry soil, the 12 m canopy with the back shell still attached 0.9 km south, and the front heat shield 1.4 km east. ESA put the site at 2.07 degrees south, 353.79 degrees east, about 5.4 km west of the aim point and comfortably inside the 100 by 15 km ellipse. That last detail is why the board's conclusion is not simply an obituary: the targeting, the entry, the parachute, the shields, the radar and the thrusters had all worked, and Schiaparelli "was very close to land successfully on Mars at the planned location". What went undemonstrated was the retro-propelled descent and the final drop, which is to say precisely the part the ExoMars rover most needed proven. The rover slipped to 2020, then 2022, and then in March 2022 ESA's Council suspended the Roscosmos cooperation entirely, taking with it the Russian descent module and landing platform. Rosalind Franklin was rebuilt around a US launch and a new European landing platform, and ESA's current factsheet gives its launch as 2028 on a Falcon Heavy.

Mission facts

What it was

The Entry, Descent and Landing Demonstrator Module of the ExoMars 2016 mission, built in Italy by Thales Alenia Space and flown to test European entry, descent and landing technology ahead of the ExoMars rover. It carried a small science payload, but with single-string avionics and non-rechargeable batteries it was never going to last long on the surface. It launched attached to the Trace Gas Orbiter on 14 March 2016 at 09:31:42 UTC on a Proton-M from Baikonur, was released by TGO on 16 October 2016 at 14:42:00 UTC with a separation delta-v slightly higher than expected but harmless, coasted ballistically for three days, and woke from hibernation on 19 October at 13:29:48 UTC.↗

The vehicle

Per the inquiry report: 577 kg after separation, 280 kg at landing. NASA-derived aeroshape with a 70 degree sphere-cone front shield and a 47 degree conical back shell, 2.4 m diameter, 1.32 m tall, Norcoat-Liege ablative material on both shields, aluminium sandwich structure with a crushable base. A 12 m supersonic disk-gap-band parachute deployed by mortar. Propulsion was three clusters of three hydrazine pulse engines of 400 N each. The avionics were single-string with no failure tolerance, a change made mid-programme under financial pressure.↗

Instruments

AMELIA used the engineering sensors to reconstruct the entry; COMARS+ measured pressure, surface temperature and heat flux on the back cover during entry; DECA was a descent camera; DREAMS was the surface package, with wind, humidity, pressure, temperature, solar irradiance and atmospheric electricity sensors; INRRI was a passive laser retroreflector array. AMELIA and COMARS+ returned useful data. DREAMS returned one housekeeping packet.↗

Entry

Entry was detected by the accelerometers at 14:42:22 UTC on 19 October 2016. The 122.5 km altitude and roughly 21,000 km/h usually quoted for that moment are pre-flight numbers from ESA's mission-control page. The inquiry does not restate them as measurements. The inquiry report's own introduction gives 14:42:07 for atmospheric entry while its event sequence gives 14:42:22 for accelerometer detection; the two are describing different things. Entry, heating and aerodynamic braking all went as designed, and the front and back shields returned engineering and science data throughout.↗

Parachute

Triggered on g-level at 14:45:23 UTC, about three minutes after entry; ESA's statement of 23 November 2016 gives 12 km altitude and 1,730 km/h. The inquiry estimates deployment at Mach 2.05 against a pre-flight predicted range of 1.88 to 2.07. Total angle of attack was about 6.5 degrees and lateral angular rate under 3 deg/s at mortar fire. Deployment to peak load took about one second, in line with prediction. The parachute inflated and worked.↗

The saturation

About 0.2 seconds after the peak parachute inflation load the IMU measured a pitch rate around the Z axis larger than it could report, and set its saturation flag. While that flag was set the guidance software integrated a rate equal to the saturation threshold, as if the vehicle were rotating steadily at the limit, when in fact it was oscillating. That produced an attitude estimation error of about 165 degrees, which corresponds to the module being almost upside down with the front shield pointing at the sky.↗

How long the flag stayed set

ESA's preliminary statement of 23 November 2016 says the saturation "persisted for about one second", longer than would be expected. The public inquiry report never prints the actual figure. What it does say is that the persistence time was not recorded at acceptance of the unit and was instead believed to be 15 ms, and that if it had been 15 ms "the landing would probably have been successful", in which case the other root causes would probably never have surfaced.↗

The negative altitude

The front shield was jettisoned on a timer at 14:46:03 UTC and the Radar Doppler Altimeter switched on at 14:46:19. The radar worked and returned coherent slant ranges. But altitude is derived by projecting those slant ranges onto the vertical using the guidance system's attitude estimate, and with a 165 degree error the projection used a cosine of an angle greater than 90 degrees, which is negative. There was no onboard check on the plausibility of a negative altitude.↗

The consistency check that failed the wrong way

The onboard software correctly detected that the radar and inertial data disagreed. The failure logic, however, assumed any such disagreement meant a radar problem, and since landing was impossible without the radar, after more than five seconds it forced the radar into the loop anyway. The attitude estimate, the other half of the calculation, was never questioned. That timeout is flagged at 14:46:46 UTC, and the software then entered TERMINAL_DESCENT, where altitude governs everything.↗

The last eight seconds

Back shell and parachute separation at 14:46:49 UTC. Reaction control system on at 14:46:51, with no back shell avoidance manoeuvre because the measured lateral velocity did not need one. RCS off at 14:46:54. The switch-off criterion compared estimated energy against a threshold, and because the estimated altitude was large and negative, the negative potential energy swamped the kinetic term and the condition was satisfied immediately. The thrusters fired for three seconds instead of about thirty. The onboard system then switched to surface mode, as if it had landed.↗

Impact

Free fall from about 3.7 km. The signal was lost at 14:47:22 UTC and impact came at 14:47:28 at an estimated 150 m/s, roughly 540 km/h. The scheduled touchdown was 14:48:05, so it hit 37 seconds early. The report describes the fall as lasting about 34 seconds in its event sequence and about 33 seconds in its findings summary; the quoted times give 34.↗

The four root causes

Insufficiently conservative modelling of parachute dynamics, so much lower rates were expected than occurred; inadequate persistence time of the IMU saturation flag and inadequate handling of saturation by the guidance software; an insufficient approach to failure detection, isolation and recovery and to design robustness; and a mishap in the management of subcontractors and acceptance of hardware. The board found no IMU malfunction: testing showed the unit performs nominally under high angular acceleration and jerk, and the rates it measured were real.↗

Why the rates were real

JPL Monte Carlo runs with a higher-fidelity parachute model produced many cases with rates above the IMU's saturation level, and post-flight reconstruction showed parachute riser angle and force variations well above anything the ExoMars end-to-end simulator predicted. The board concluded that oscillation of parachute force caused by canopy area oscillation alone can explain the rates, and that area oscillation was simply not in the multi-body model. Comparing the flight data with NASA wind-tunnel tests at similar Mach numbers and with NASA flight experience, its verdict was that "such high parachute dynamics were to be expected".↗

What the software did and did not do wrong

An ESA software and systems assessment concluded the flight software performed as specified, including faithfully propagating a sign error that came from an incomplete requirement in the guidance algorithm model about the sign of the angular rate under saturation. Post-flight testing showed the sign error made no difference, because what mattered was how long the saturation flag persisted; which way the false rotation accumulated was irrelevant. The board issued 16 recommendations, eight general and eight specific to the follow-on mission.↗

What was found on the ground

MRO's context camera imaged a fuzzy dark patch roughly 15 by 40 m on 20 October 2016, with a bright spot about 1 km to the south. HiRISE on 25 October resolved a central dark spot 2.4 m across, consistent with a roughly 300 kg object hitting dry soil, and a crater predicted to be about 0.5 m deep; the 12 m parachute with the back shell still attached about 0.9 km south; and the front heat shield about 1.4 km east. A colour image on 1 November confirmed that bright specks around the crater were real objects, most likely fragments, and showed the parachute had shifted west in the wind.↗

What the demonstration did prove

The board's conclusion lists as successfully demonstrated: separation from TGO, wake-up after the coast, detection of the atmosphere, entry and aerobraking, parachute deployment triggering, parachute deployment and inflation, front shield jettison, radar altimeter operation, back shell and parachute separation, reaction control system priming and firing, and the switch to surface mode with instrument initialisation, which happened during the free fall. Not demonstrated: the retro-propelled descent to the two-metre drop point, and surviving that drop.↗

Mission timeline

14 Mar 2016Launch at 09:31:42 UTC on a Proton-M/Breeze-M from Baikonur, attached to the Trace Gas Orbiter, for a seven-month cruise.
16 Oct 2016Separation from TGO at 14:42:00 UTC onto a direct intercept course, followed by three days of ballistic coast in hibernation.
19 Oct 201613:29:48 UTC wake-up; 14:42:22 entry detected by accelerometers, at the roughly 122.5 km and 21,000 km/h ESA had predicted. Entry and aerodynamic braking are nominal, and the shields return data throughout.
19 Oct 201614:45:23 UTC: parachute deploys, at 12 km and 1,730 km/h by ESA's later account, an estimated Mach 2.05. About 0.2 s after peak inflation load the IMU saturates in pitch. The guidance software integrates the saturation-threshold rate and builds an attitude error of about 165 degrees.
19 Oct 201614:46:03 UTC front shield jettisoned on a timer; 14:46:19 radar altimeter on, returning good slant ranges. Projected through the corrupted attitude, those ranges yield a negative altitude, and nothing on board checks whether that is possible. At 14:46:46 the radar-inertial consistency check has failed for more than five seconds, so the radar is forced into the loop on the logic that landing without it is impossible, and terminal descent begins governed by an altitude that is wrong.
19 Oct 201614:46:49 UTC back shell and parachute separate; 14:46:51 thrusters light; 14:46:54 thrusters shut down, three seconds in, because the energy criterion is immediately satisfied by a large negative altitude. The module switches to surface mode at about 3.7 km.
19 Oct 201614:47:22 UTC signal lost, 43 seconds before the scheduled touchdown. 14:47:28 impact at about 150 m/s. Expected landing time was 14:48:05. TGO, entering orbit at that moment, had recorded the whole descent.
20 Oct 2016MRO's context camera finds a new dark patch about 15 by 40 m near the target, with a new white spot about 1 km south. ESA gives the position as 2.07 S, 353.79 E, roughly 5.4 km west of the aim point and well inside the landing ellipse.
25 Oct to 1 Nov 2016HiRISE resolves a 2.4 m dark spot at the impact site, the 12 m parachute with the back shell attached 0.9 km south, and the front heat shield 1.4 km east. The colour frame of 1 November confirms bright specks near the crater as real objects and shows the parachute has moved in the wind.
23 Nov 2016ESA publishes the preliminary finding: the IMU saturated shortly after parachute deployment, the event "persisted for about one second", the merged navigation solution produced a negative altitude, and the module was in reality still at about 3.7 km.
17 Apr to 24 May 2017The Schiaparelli Inquiry Board, chaired by ESA Inspector General Toni Tolker-Nielsen with members from CNES, DLR, NASA/JPL, serving and retired ESA staff, two Italian universities and one German one, issues its report on 17 April. The public abbreviated version, reference DG-I/2017/546/TTN, is dated 18 May, and ESA announces the findings and 16 recommendations on 24 May.
17 Mar 2022ESA's Council suspends the ExoMars rover cooperation with Roscosmos after the invasion of Ukraine. That rover, the mission Schiaparelli had been flown to de-risk, had already slipped from 2018 to 2020 to 2022; the suspension cost it the Russian-built descent module and landing platform. ESA now gives its launch as 2028, on a Falcon Heavy.