5 ms·

Well, common sense in a way would be enabled with assertions. But even if you know that you cannot be below ground, how would you recover? Your sensors clearly

by ygra 10y ago

Well, common sense in a way would be enabled with assertions. But even if you know that you cannot be below ground, how would you recover? Your sensors clearly tell you that you're below ground, so what is the course of action? You have no way of knowing where you are, you just know that you don't know. It doesn't really change anything in the outcome. Sure, maybe you could go from altitude measurements to time measurements and most likely still leave a crater since it's not exact enough (there's a reason for the internal measurement instead of simpler ways, after all). It would also require you to anticipate the malfunction in which case you already know that things like that could happen, in which case you'd likely determine how it could happen and how to avoid it and continue having useful data. Sounds to me like a better solution than trying to recover without data.

grondilu 10y ago
From the article: > This in turn successively triggered a premature release of the parachute and the backshell, a brief firing of the braking thrusters and finally activation of the on-ground systems as if Schiaparelli had already landed. It would have been better to do nothing, in the hope that the altimeter data will resume to reasonable values, especially since the article mentions that the error is not supposed to last long: > Its output was generally as predicted except for this event, which persisted for about one second – longer than would be expected.
WalterBright 10y ago
There are several ways. First off, ignore the erroneous data. Then, estimate the altitude by other methods. As you mentioned, one way would be to integrate time and velocity. All inputs and outputs should be run through sanity checks, with a plan for when they go wrong. Essentially, when you've got a system that can't be fixed, plan for failure of each and every component (in isolation).
- homero 10y ago
  Cars do this, you can kill many sensors and an engine will still limp even with misfires. I guess consulting Bosch isn't an option tho
  - ethbro 10y ago
    Some cars do this. My friend's Honda literally stopped combustion when his battery died while driving (no, I have no idea how, but that was the diagnosis). In contrast, I've limped my Miata along on alternator-only when the battery wouldn't hold a charge. Note: feathering the gas at a stop with brakes and clutch depressed to keep your spark from dying is an "interesting" experience.
    - dotancohen 10y ago
      At a stop pull the tranny out of gear and activate the parking brake. More fun is driving a vehicle with no clutch: stalling at every stop and starting the motor in first gear, and shifting without clutching. I had to do that in my '83 280ZX in its last days.
    - dotancohen 10y ago
      At a stop pull the tranny out of gea and activate the parking brake. More fun is driving a vehicle with no clutch: stalling at every stop and starting the motor in first gear, and shifting without clutching. I had to do that in my '83 280ZX in its last days.
  - matheweis 10y ago
    Not necessarily very well; my cars' mass airflow sensor went out a few months back... the performance was all over the place and sudden engine stalls were frequent. You could kill the engine just by accelerating quickly when it was cold. ... and that was a single sensor out.
  - TorKlingberg 10y ago
    It helps that car engines don't really _need_ sensors to function. Cars existed before electronic sensors. A mars lander actually needs to know when to deploy parachutes.
    - WalterBright 10y ago
      If the lander cannot function without an altimeter, and there is only one altimeter with no backup plan, then you can plan to lose the lander. This is not a new idea. Airplanes cannot fly without instruments, and all the instruments have backups and alternate means. Everything deemed "flight critical" has a backup alternative.
acqq 10y ago
> your sensors clearly tell you that you're below ground They weren't telling that. As far as I understood, the sensors were fully right, the software just hasn't expected the rotation to last "so long" -- the whole second, so it calculated the result wrong ("negative height") by incorrectly processing these multiple (in time) for their model unexpected inputs.
blutack 10y ago
For context, the lander did have a radar altimeter. A radar altimeter has maximum distance from ground above which it will not establish a lock. If radar altimeter had never had a lock, either the radar altimeter has faulted in a way you can't detect, or you are above the lock range for your radar altimeter. If the radar altimeter had locked, you have a very accurate measurement of height above ground.
- moioci 10y ago
  That's the surprising thing, though: "its radar Doppler altimeter functioned correctly and the measurements were included in the guidance, navigation and control system. "
  - pbhjpbhj 10y ago
    And presumably mission time was in use too? Presumably they know to the (milli?)second when the lander should touchdown, at least from the point where the lander starts its descent. Time of flight send like a very strong, reliable signal?
dean 10y ago
Better to discard obviously bad data altogether. The system certainly should not act on that data, as seems to have been the case here.
- mediocrejoker 10y ago
  I would argue that at 1700 km/h, even not acting is an action. The decision to do nothing is still a decision.

by ygra 10y ago

grondilu 10y ago

From the article: > This in turn successively triggered a premature release of the parachute and the backshell, a brief firing of the braking thrusters and finally activation of the on-ground systems as if Schiaparelli had already landed. It would have been better to do nothing, in the hope that the altimeter data will resume to reasonable values, especially since the article mentions that the error is not supposed to last long: > Its output was generally as predicted except for this event, which persisted for about one second – longer than would be expected.

WalterBright 10y ago

There are several ways. First off, ignore the erroneous data. Then, estimate the altitude by other methods. As you mentioned, one way would be to integrate time and velocity. All inputs and outputs should be run through sanity checks, with a plan for when they go wrong. Essentially, when you've got a system that can't be fixed, plan for failure of each and every component (in isolation).

homero 10y ago
Cars do this, you can kill many sensors and an engine will still limp even with misfires. I guess consulting Bosch isn't an option tho
- ethbro 10y ago
  Some cars do this. My friend's Honda literally stopped combustion when his battery died while driving (no, I have no idea how, but that was the diagnosis). In contrast, I've limped my Miata along on alternator-only when the battery wouldn't hold a charge. Note: feathering the gas at a stop with brakes and clutch depressed to keep your spark from dying is an "interesting" experience.
  - dotancohen 10y ago
    At a stop pull the tranny out of gear and activate the parking brake. More fun is driving a vehicle with no clutch: stalling at every stop and starting the motor in first gear, and shifting without clutching. I had to do that in my '83 280ZX in its last days.
  - dotancohen 10y ago
    At a stop pull the tranny out of gea and activate the parking brake. More fun is driving a vehicle with no clutch: stalling at every stop and starting the motor in first gear, and shifting without clutching. I had to do that in my '83 280ZX in its last days.
- matheweis 10y ago
  Not necessarily very well; my cars' mass airflow sensor went out a few months back... the performance was all over the place and sudden engine stalls were frequent. You could kill the engine just by accelerating quickly when it was cold. ... and that was a single sensor out.
- TorKlingberg 10y ago
  It helps that car engines don't really _need_ sensors to function. Cars existed before electronic sensors. A mars lander actually needs to know when to deploy parachutes.
  - WalterBright 10y ago
    If the lander cannot function without an altimeter, and there is only one altimeter with no backup plan, then you can plan to lose the lander. This is not a new idea. Airplanes cannot fly without instruments, and all the instruments have backups and alternate means. Everything deemed "flight critical" has a backup alternative.

acqq 10y ago

> your sensors clearly tell you that you're below ground They weren't telling that. As far as I understood, the sensors were fully right, the software just hasn't expected the rotation to last "so long" -- the whole second, so it calculated the result wrong ("negative height") by incorrectly processing these multiple (in time) for their model unexpected inputs.

blutack 10y ago

For context, the lander did have a radar altimeter. A radar altimeter has maximum distance from ground above which it will not establish a lock. If radar altimeter had never had a lock, either the radar altimeter has faulted in a way you can't detect, or you are above the lock range for your radar altimeter. If the radar altimeter had locked, you have a very accurate measurement of height above ground.

moioci 10y ago
That's the surprising thing, though: "its radar Doppler altimeter functioned correctly and the measurements were included in the guidance, navigation and control system. "
- pbhjpbhj 10y ago
  And presumably mission time was in use too? Presumably they know to the (milli?)second when the lander should touchdown, at least from the point where the lander starts its descent. Time of flight send like a very strong, reliable signal?

dean 10y ago

Better to discard obviously bad data altogether. The system certainly should not act on that data, as seems to have been the case here.

mediocrejoker 10y ago
I would argue that at 1700 km/h, even not acting is an action. The decision to do nothing is still a decision.