Mars Polar Lander

Pathfinder broadened our understanding of Mars and paved the way for future exploration by showing that the new, inexpensive exploration technologies can work. However, no lander has managed to land successfully on Mars since Pathfinder. The U.S. mission Mars Polar Lander erashed near the Martian south pole in 2000, prompting widespread questioning of the claim—seemingly proved by Pathfinder s spectacular success— that Mars missions could be built faster, cheaper, and better. 

Mars Polar Lander/ Deep Space 2 USA Mars January 3,1999... 

The Mars Polar Lander loss is a component interaction accident. Such acddents arise in the interactions among system components (electromechanical, digital, human, and social) rather than in the failure of individual components. In contrast, the other main type of accident, a component failure accident, results from component failures, including the possibility of multiple and cascading failures. In component failure accidents, the failures are usually treated as random phenomena. In component interaction accidents, there may be no failures and the system design errors giving rise to unsafe behavior are not random events. 

Accidents hke the Mars Polar Lander or the British batch chemical reactor losses, where the cause lies in dysfunctional interactions of non-failing, reliable components—i.e., the problem is in the overaU system design—illustrate reliable components in an unsafe system. There can also be safe systems with unreliable components if the system is designed and operated so that component failures do not create hazardous system states. Design techniques to prevent accidents are described in chapter 16 of Safeware. One obvious example is systems that are fail-safe, that is, they are designed to fail into a safe state. 

In the Mars Polar Lander loss, the software requirements did not include information about the potential for the landing leg sensors to generate noise or, alternatively, to ignore any inputs from the sensors while the spacecraft was more than forty meters above the planet surface. In the batch chemical reactor accident, the software engineers were never told to open the water valve before the catalyst valve and apparently thought the ordering was therefore irrelevant. 

The model condition plays an important role in accidents and safety. In order to create effective control actions, the controller must know the current state of the controlled process and be able to estimate the effect of various control actions on that state. As discussed further in section 4.3, many accidents have been caused by the controller incorrectly assuming the controlled system was in a particular state and imposing a control action (or not providing one) that led to a loss the Mars Polar Lander descent engine controller, for example, assumed that the spacecraft... 

At Bhopal, the safety constraint that was violated was that the MIC must not come in contact with water. In the Mars Polar Lander, the safety constraint was that the spacecraft must not impact the planet surface with more than a maximum force. 

Component interaction accidents can usually be explained in terms of incorrect process models. For example, the Mars Polar Lander software thought the spacecraft had landed and issued a control instruction to shut down the descent engines. The captain of the Herald of Free Enterprise thought the ferry doors were closed and ordered the ship to leave the mooring. The pilots in the Cali Colombia B757 crash thought R was the symbol denoting the radio beacon near Cali. 

Euler, E. E., S. D. Jolly, and H. H. Curtis. 2001. The failures of the Mars climate orbiter and Mars polar lander A perspective from the people involved. Guidance and Control, American Astronautical Society, paper AAS 01-074. 

JPL Special Review Board. Report on the loss of the Mars polar lander and deep space 2 missions. NASA Jet Propulsion Laboratory, 22 March 2000. 

JPL also developed a laser diode-based gas analyzer as part of the 1999 Mars Polar Lander mission to explore the possibility of life-giving elements on Mars. It has since been used on aircraft and on balloons to study weather and climate, global warming, emissions from aircraft, and numerous other areas where chemical-gas analysis is needed. 

Leveson uses the example of the loss of the Mars Polar Lander to highlight that although the landing legs and onboard software each worked correctly, together they resulted in the premature shutdown of the engines (Leveson 2010). 

In the second half of 1999, there were mission failures involving the Columbia shuttle and then dual failures with the Mars probe. The Mars probe failures came after a big success in 1997. The Mars Climate Orbiter failed to find a proper trajectory around Mars and the Mars Polar Lander was lost, believed crashed. Including the 1999 mission failures NASA attempted to fly 16 FBC missions in 1992-2000, with a 63 percent success rate. 

FIGURE 32.25 Mars Polar Lander 16-Ah CPV battery assembly. 

In 1993, NASA started the Mars Surveyor program to conduct an ongoing series of missions to explore Mars. In 1995, two missions were scheduled that would be launched in late 1998 and early 1999. The missions were the Mars Climate Orbiter (MCO) and the Mars Polar Lander (MPL). The MCO was launched December 11, 1998, and the MPL, January 3,1999. 

---