Weird Science History

Loading

Science Gone Wrong · Space

The Mars Lander That Thought It Was Already Underground — While Still 3.7 Kilometers Up

On October 19, 2016, Europe's Schiaparelli lander was drifting under its parachute toward Mars when its computer reached a confident and very wrong conclusion: it was already below the ground. So it did what a landed spacecraft should do. It let go of its parachute, fired its braking thrusters for three seconds instead of thirty, and switched on its surface instruments — while still about 3.7 kilometers in the air.

By the Curiosities Desk · · 5 min read · Filed under Space · Today’s round

Part of The Missions Undone by One Small Thing

The Mars Lander That Thought It Was Already Underground — While Still 3.7 Kilometers Up

What happened: The Schiaparelli Lander

Schiaparelli was the landing half of ExoMars 2016, a joint mission of the European Space Agency (ESA) and Russia’s space agency, Roscosmos. It launched from Baikonur in March 2016 riding alongside the Trace Gas Orbiter, a spacecraft designed to sniff the Martian atmosphere from above. Schiaparelli’s main job was not science but rehearsal: Europe had never landed anything successfully on Mars, and this 577-kilogram test module was meant to prove out a parachute, a radar altimeter (an instrument that measures height by bouncing radio waves off the ground), and a ring of thrusters before a future rover trusted its life to them.

The two spacecraft separated on October 16, and Schiaparelli coasted for three days. At 14:42 UTC on October 19, it hit the top of the Martian atmosphere. According to ESA’s inquiry board, things went to plan at first. The heat shield took the friction of entry. A little over three minutes later, at roughly twice the speed of sound, the parachute burst open.

That’s where the trouble began. As the parachute inflated, it oscillated, and the whole capsule swung more violently than engineers’ computer models had predicted. On board, an inertial measurement unit (IMU) — a box of sensors that tracks how fast a spacecraft is rotating — tried to measure the spin. The rotation was so fast that the sensor “saturated,” meaning it hit the top of its scale and simply reported the maximum. ESA’s preliminary findings said this lasted about one second.

One second was enough. The saturation flag stayed raised longer than it should have, and during that time the navigation software kept adding up rotation that hadn’t happened in the way it calculated. When the error settled in, the computer believed the capsule’s orientation was off by about 165 degrees — roughly upside down, with its heat shield pointing at the sky.

The radar altimeter, meanwhile, was working perfectly, faithfully reporting the distance to the ground. But the computer combined those accurate distances with its badly wrong sense of which way was up. Projected through an upside-down attitude, the numbers produced a negative altitude. In the computer’s understanding of the world, Schiaparelli was underground.

Its software responded logically. At 14:46:49 it released the back shell and parachute. Two seconds later the thrusters lit, and at 14:46:54 they shut off — roughly three seconds into what should have been a thirty-second burn. The lander then started its on-ground routine, including switching to surface mode and starting up its instruments, all during free fall. It struck the plain of Meridiani Planum at about 540 kilometers per hour (around 335 mph), some 37 seconds before its planned landing time.

Six days later, NASA’s Mars Reconnaissance Orbiter photographed the scene: a dark impact scar, the heat shield about 1.4 kilometers to the east, and the parachute and back shell lying side by side about 0.9 kilometers to the south.

Why it was strange: The Schiaparelli Lander

Most spacecraft failures involve something breaking. Here, almost nothing did. The parachute opened, the radar measured correctly, and the thrusters fired when commanded. ESA said afterward that the module had come “very close to landing successfully at the planned location.”

The failure lived entirely inside the lander’s beliefs. A single second of overwhelmed sensor data gave it a false picture of reality, and every system after that followed the false picture flawlessly. It’s a little like a sleepwalker who confidently “arrives home” in the middle of the street: every step is well executed, and the starting assumption is wrong.

Mars has a long record of missions undone by small things, from a units mix-up to a backward switch. Compare The Unit Mix-Up That Doomed a Mars Probe.

What scientists learned: The Schiaparelli Lander

ESA’s Schiaparelli Inquiry Board reported in May 2017 that several causes stacked together. The models of parachute behavior had underestimated how hard the capsule could swing. The IMU’s saturation flag was set to persist for too long, and the guidance software didn’t handle saturation in a way that protected against bad data. And there were gaps in how the spacecraft checked itself for faults and how hardware from subcontractors was accepted and verified.

The board’s recommendations read like advice for any thinking machine. Among them: add sanity checks on altitude and attitude, including whether a number’s sign even makes sense. A falling lander that suddenly calculates a negative height should treat that as a red flag, not a cue to celebrate.

There was a silver lining. Because Schiaparelli streamed its telemetry in real time — recorded by the Trace Gas Orbiter, Mars Express, and India’s Giant Metrewave Radio Telescope near Pune — engineers could reconstruct the descent second by second. Another lander whose story depended on what happened after it was out of sight: The Mars Lander That Carried a Blur Ringtone and a Damien Hirst Painting — and Then Went Quiet for 11 Years.

How it reaches us today: The Schiaparelli Lander

The ExoMars descent data gave Europe its first real-world measurements of a parachute opening and a radar altimeter working at Mars. The radar’s success was a genuine result, and the inquiry’s lessons — better parachute models, correct saturation thresholds, two IMUs instead of one, onboard plausibility checks — were written directly into plans for the mission that followed.

That mission, carrying the Rosalind Franklin rover, has had a long road since. ESA now plans to launch it in 2028 with a European-built landing platform. When it descends, its software will be expected to ask a question Schiaparelli didn’t: does this answer make sense?

The wider lesson travels well beyond Mars. Self-driving cars, aircraft autopilots, and even phone navigation all blend imperfect sensors into a single picture of the world. Engineers now design these systems to doubt themselves a little. A similar story of one tiny assumption bringing down careful hardware: The Genesis Capsule That Crashed Because a Switch Was Installed Backward.

Fun fact: The Schiaparelli Lander

The lander was named for Giovanni Schiaparelli, the 19th-century Italian astronomer famous for sketching Martian “canali” that later turned out to be largely optical illusions. More than a century later, the spacecraft carrying his name was undone by seeing ground on Mars that wasn’t there.

Sources: The Schiaparelli Lander

Related stories: The Schiaparelli Lander

← Back to the archive