ExoMars - Schiaparelli landing |
![]() ![]() |
ExoMars - Schiaparelli landing |
![]()
Post
#166
|
|
Senior Member ![]() ![]() ![]() ![]() Group: Members Posts: 1339 Joined: 14-October 05 From: Vermont Member No.: 530 ![]() |
ESA has told us that they have simulated the fault and it matches what happened. OK.... but... The problem is that the 'glitch' makes as much sense as the Italian Space Agency's story a few days ago. And there is a very good reason for that. We have no insight into the EDL software design used by the ESA designers and programmers As an RTOS programmer for decades (VxWorks, also used by MER, Pathfinder, Odyssey, etc) , sanity checks are part of the landscape. For example: when the craft is at an altitude of 4 Km and in the next second it thinks it is 'on the ground', one of the background sanity checks would have said 'we just accelerated to 14 Million KM/hr -- ignore the readings, wait until they get back in 'range', and do it again. .... Ariane V initial launch? It would have failed your sanity checks. Nonetheless he software commanded a wild course correction. I just don't know how many layers of "wait and see" you're supposed to put in there though. Ariane V may well have had plenty of "wait and see" but not amount of it was going to undo the overflow. You can reject a certain amount of garbage data, but eventually that might be all you have left. |
|
|
![]()
Post
#167
|
|
Member ![]() ![]() ![]() Group: Members Posts: 122 Joined: 10-December 06 From: Atlanta Member No.: 1472 ![]() |
There is a limit of the number of such sanity checks you can explicitly implement in a control system. You get a huge number of rules because you need to consider different combinations of inputs. Instead, since the time of Apollo, most (all?) s/c control systems have used Kalman filter or one of its descendants. The basic idea is that each piece of input comes with a measure of its accuracy that affects how it is incorporated into a state vector. It seems that for Schiaparelli, the control system assigned a higher accuracy to IMU inputs than to the radar readings and therefore rejects radar inputs in favor of the wrong state vector generated from IMU.
|
|
|
![]()
Post
#168
|
|
![]() Member ![]() ![]() ![]() Group: Members Posts: 248 Joined: 15-June 09 From: Lisbon, Portugal Member No.: 4824 ![]() |
ESA has just announced that the Schiaparelli landing investigation has been completed. A report summary can be downloaded from this page.
Here is an excerpt: QUOTE Around three minutes after atmospheric entry the parachute deployed, but the module experienced unexpected high rotation rates. This resulted in a brief 'saturation' – where the expected measurement range is exceeded – of the Inertial Measurement Unit, which measures the lander's rotation rate. The saturation resulted in a large attitude estimation error by the guidance, navigation and control system software. The incorrect attitude estimate, when combined with the later radar measurements, resulted in the computer calculating that it was below ground level. This resulted in the early release of the parachute and back-shell, a brief firing of the thrusters for only 3 sec instead of 30 sec, and the activation of the on-ground system as if Schiaparelli had landed. The surface science package returned one housekeeping data packet before the signal was lost. Fernando |
|
|
![]()
Post
#169
|
|
Senior Member ![]() ![]() ![]() ![]() Group: Members Posts: 1647 Joined: 13-September 05 Member No.: 497 ![]() |
A report summary can be downloaded from this page. Wow. Basically there were several issues, but there was one parameter that was supposed to be 15 msec and was set to some unstated larger value and nobody caught it. QUOTE It should be borne in mind that if the persistence time of the IMU saturation flag would have been 15 ms the landing would probably have been successful, in which case the other root causes would probably never have been identified. That's gotta hurt. -------------------- Disclaimer: This post is based on public information only. Any opinions are my own.
|
|
|
![]()
Post
#170
|
|
![]() Senior Member ![]() ![]() ![]() ![]() Group: Members Posts: 1484 Joined: 13-February 10 From: Ontario Member No.: 5221 ![]() |
It always does. Just like Mars Observer and the metric mixup, or Galileo and the HGA, or Genesis accelerators being upside down, or (for ESA) the Huygens Channel A. Nothing to do but live with it and learn from mistakes.
|
|
|
![]()
Post
#171
|
|
Senior Member ![]() ![]() ![]() ![]() Group: Members Posts: 1647 Joined: 13-September 05 Member No.: 497 ![]() |
Just like Mars Observer and the metric mixup... That's Mars Climate Orbiter. The Mars Observer problem was a lot more subtle (as was the Galileo problem.) -------------------- Disclaimer: This post is based on public information only. Any opinions are my own.
|
|
|
![]()
Post
#172
|
|
![]() Senior Member ![]() ![]() ![]() ![]() Group: Members Posts: 1484 Joined: 13-February 10 From: Ontario Member No.: 5221 ![]() |
Oops, yes. Looking at the report, I note that they used the observations Oppy took of its heat shield during their analysis. Good use of ground truth and previous experience to build on for the future.
Also from page 18, for something this thread discussed: QUOTE SIB members confirmed that the cancelled subsonic High Altitude Drop Test would not have revealed the underestimated supersonic dynamic behaviour of the parachute at Mach 2
|
|
|
![]()
Post
#173
|
|
![]() Member ![]() ![]() ![]() Group: Members Posts: 598 Joined: 10-October 06 From: Maynard Mass USA Member No.: 1241 ![]() |
As mentioned upstream in the thread, a few overriding sanity checks can and should be layered on top of the real-time Kalman NAV computer in an EXEC manner.
(underlines are mine) (ESA) Recommendation 05 – Robust and reliable sanity checks shall be implemented in the on-board S/W to increase the robustness of the design, which could be, but not limited to : - Check on attitude - Check on altitude sign (altitude cannot be negative). - Check on vertical acceleration during terminal descent and landing (cannot be higher than gravity). - Check altitude magnitude change (it cannot change from 3.7 Km to a negative value in one second). - Check wrt pre-flight timeline (altitude or acceleration profile vs time) to check consistency of measurements Let's get this done and see a working 2020 lander on the surface of Mars! -------------------- CLA CLL
|
|
|
![]() ![]() |
![]() |
Lo-Fi Version | Time is now: 22nd April 2018 - 03:18 AM |
RULES AND GUIDELINES Please read the Forum Rules and Guidelines before posting. IMAGE COPYRIGHT |
OPINIONS AND MODERATION Opinions expressed on UnmannedSpaceflight.com are those of the individual posters and do not necessarily reflect the opinions of UnmannedSpaceflight.com or The Planetary Society. The all-volunteer UnmannedSpaceflight.com moderation team is wholly independent of The Planetary Society. The Planetary Society has no influence over decisions made by the UnmannedSpaceflight.com moderators. |
SUPPORT THE FORUM Unmannedspaceflight.com is a project of the Planetary Society and is funded by donations from visitors and members. Help keep this forum up and running by contributing here. |
![]() |