The Schiaparelli module (also called EDM) was part of the ExoMars 2016 mission launched on 14 March 2016 on a Proton rocket from the Baikonur Cosmodrome launch site in Kazakhstan. The EDM was conceived with the objective to validate and demonstrate entry, descent and landing on Mars in preparation for the ExoMars 2020 mission.
On the basis of the outcome of the investigations performed, the SIB members identified four main root causes that led to the Schiaparelli failure:
- – Insufficient conservative modelling of the parachute dynamics which led to expect much lower dynamics than observed in flight;
- – Inadequate persistence time of the IMU saturation flag and inadequate handling of IMU saturation by the GNC;
- – Insufficient approach to FDIR and design robustness;
- – Mishap in management of subcontractors and acceptance of hardware, (the persistence of IMU saturation time was not recorded at acceptance and instead believed to be 15 ms).
The sequence (timeline) of the events is reported below with respect to UTC time.
a) Separation from TGO on 16/10/2016 at 14:42:00.
b) Awakening from hibernation on 19/10/2016 at 13:29:48.
c) Entry in the Mars atmosphere (EIP) detected at 14:42:22 through accelerometers.
d) Between EIP and Parachute Deployment triggering, an unexpected evolution in the spin rate of the EDM was noticed.
e) At 14:45:23 the parachute deployment was triggered (trigger is the g-level). – The dynamic conditions at the moment of parachute deployment derived from telemetry showed a total angle of attack (AOA) estimated of about 6.5 deg and a lateral angular rate < 3 deg/s
f) Parachute deployment time (time from mortar firing to peak load factor) was circa 1 sec (in line with the predictions). – The parachute was deployed, and the parachute inflation triggered some oscillations of Schiaparelli at a frequency of approximately 2.5 Hz. – About 0.2 sec after the peak load of the parachute inflation, the IMU measured a pitch angular rate (angular rate around Z-EDM axis) larger than expected. – The IMU raised a saturation flag,. – During the period the IMU saturation flag was set, the GNC Software integrated an angular rate assumed to be equal to the saturation threshold rate. The integration of this constant angular rate, during which the EDM was in reality oscillating, led to an error in the GNC estimated attitude of the EDM of about 165 degrees. This would correspond to an EDM nearly turned downside up with the front shield side pointing to quasi-zenith. – After the parachute inflation, the oscillatory motion of Schiaparelli under its parachute was mostly damped and Schiaparelli was descending at a nominal descent rate, with very small oscillations (< 3 deg) around pitch and yaw axis.After parachute inflation the angular acceleration around the spin axis changed again
g) The Front Shield was jettisoned as planned 40s after parachute deployment (timer based command) at 14:46:03
h) The RDA was switched on at 14:46:19 (15s after Front Shield separation acknowledgment) and provided coherent slant ranges, without any indication of anomalies; – Once the RDA is on, RIL mode, “consistency checks” between IMU and RDA measurements are performed. The parameters checked are: delta velocity and delta altitude. The altitude is obtained using the GNC estimated attitude to project the RDA slant ranges on the vertical. – Because of the error in the estimated attitude that occurred at parachute inflation, the GNC Software projected the RDA range measurements with an erroneous off-vertical angle and deduced a negative altitude (cosinus of angles > 90 degrees are negative). There was no check on board of the plausibility of this altitude calculation
i) Consequently the “consistency check” failed for more than 5 sec. after which the RDA was forced anyway into the loop based on the logic that landing was impossible without the RDA. The correctness of the other contributor to the altitude estimation, i.e. the attitude estimate, was not put in question. The RDA was put in the loop (event signalled by RIL time-out flag at 14:46:46). – The GNC mode entered was TERMINAL DESCENT where the altitude is scrutinized to release the Back-Shell and parachute if the altitude is below an on board calculated limit. Because of the incorrect attitude estimation leading to an estimated negative altitude, the GNC Software validated the conditions for separating the back-shell and parachute
j) Back-shell separation at 14:46:49.
k) Switch-on of the Reaction Control System (RCS). – First RCS thruster operation was at 14:46:51 (no backshell avoidance manoeuvre)
l) Switch-off of the RCS 3 seconds later at 14:46:54. – The criterion for the RCS switch-off was based on the estimation of the EDM energy (as combination of the altitude and vertical velocity) being lower than a pre-set threshold. Since the estimation of the altitude was negative and very big, the negative potential energy was much higher than the positive kinetic energy (square of the velocity) and this criterion was immediately satisfied the RCS was commanded off as soon as allowed by the thruster modulation logic. This occurred just 3 seconds after the RCS switch on command when the capsule was at an altitude of about 3.7 km, leading to a free fall of Schiaparelli and to the impact on Mars surface about 34 seconds later.
m) The Touch Down occurred at 14:47:28 corresponding to the crash of the surface platform on the surface of Mars at an estimated velocity of ≈150 m/s. The expected landing time was 14:48:05 (some 37s later).
