The Schiaparelli Analysis

This is a simple analysis of the Schiaparelli failure using formal methods

The Schiaparelli was part of the ExoMars 2016 mission launched on a Proton rocket from the Baikonur Cosmodrome in Kazakhstan. The EDM, as it also known, was conceived with the objective to validate and demonstrate entry, descent and landing on Mars in preparation for the ExoMars 2020 mission. On 19 October 2016, the Schiaparelli module entered the Mars atmosphere at 14:42:07 (UTC). Schiaparelli continuously transmitted data during its descent into the Martian atmosphere. Schiaparelli’s signal was lost at 14:47:22 (UTC), about 43 seconds before the expected touchdown on Mars surface.
A detailed failure analysis is reported as a document. The main cause was a large oscillatory body rate that caused the inertial sensor to saturate. The saturated value was integrated to provide the attitude angle. Cosine of this term was multiplied by the radio altimeter to get the correct height. During descent the angle became as high as 160 degrees causing a negative altitude to be sent into the controller which switched off the retro rockets.

Simulink design verifier is used to find out if there is a chance of the altitude being negative. It brings out a counter example indicating how the altitude can be negative. Users can open the persistence block and change the value of 15 to lower. This change does not cause a negative altitude. This is also the finding in the report.

This is a trivial example meant for students. This can be used in a formal methods class by the instructor.

I would like to acknowledge Chethan CU who helped me with the problem and model.