REG NASA-LLIS-0938-2001 Lessons Learned Probable Scenario for Mars Polar Lander Mission Loss (1998).pdf

1、Lessons Learned Entry: 0938Lesson Info:a71 Lesson Number: 0938a71 Lesson Date: 2001-02-15a71 Submitting Organization: JPLa71 Submitted by: David A. NicholsSubject: Probable Scenario for Mars Polar Lander Mission Loss (1998) Abstract: Neither the MPL software requirements specification nor the softwa

2、re, subsystem or system test plans required verification of immunity to transient signals. MPL touchdown sensors generated known transient signals at leg deployment. Full leg deployment test was not repeated after wiring corrections. Tests should be re-run after test deficiencies are corrected or ha

3、rdware or software is revised unless clear rationale exists for not doing so. Hardware operational characteristics, including transients and spurious signals must be reflected in software requirements and verified by test.Description of Driving Event: The Mars Polar Lander (MPL) flight software did

4、not take into account certain known hardware characteristics. Resulting mission-critical failure modes were not detected during testing of the spacecraft.It was known that the touchdown sensors generated false momentary signals at leg deployment. This transient behavior was not properly accounted fo

5、r in the software design. It is believed that these momentary signals were recorded as valid touchdown events, resulting in the engines shutting down at an altitude of 40 meters. The resultant free fall to the surface of Mars is viewed as the probable cause of the December 1999 MPL mission loss (Ref

6、erences 1 and 2).Neither the software requirements specification nor the software, subsystem or system test plans required verification of transient signal immunity. Therefore it was never verified.Wiring errors in the touchdown sensors prevented registry of the touchdown or detection of the false t

7、ransient signal during the first system-level leg deployment test.Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-A full leg deployment test was not repeated after the wiring was corrected. However, the footpads were again manually depressed and the

8、sensors successfully registered a touchdown. A rerun of the complete deployment test with the correct wiring would probably have detected the softwares inability to disregard the false momentary signal caused by leg rebound.References:1. Mars Program Independent Assessment Team Summary Report (Young

9、 Report), 14 March 2000.2. Report on the Mars Polar Lander and Deep Space 2 Missions, JPL Special Review Board (Casani Report), JPL Internal Document D-18709, 22 March 2000, Section 7.7.3. JPL Corrective Action Notice No. Z69163, Mars Program Investigation Results: “Software Design“, 4 May 2000.4. J

10、PL Lesson Learned, Software Error in the MPL Uplink Loss Timer.Additional Key Words: Software Test, System Integration and Test, Test PlanningLesson(s) Learned: 1. Project test policy and procedures should specify actions to be taken when a failure occurs during test. When tests are aborted, or know

11、n to have had flawed procedures, they must be rerun after the test deficiencies are corrected. When test article hardware or software is changed, the test should be rerun unless there is a clear rationale for omitting the rerun.2. All known hardware operational characteristics, including transients

12、and spurious signals, must be reflected in the software requirements documents and verified by test.Recommendation(s): See Lesson(s) LearnedEvidence of Recurrence Control Effectiveness: A JPL Corrective Action Notice (Reference 3) was assigned and practices will be modified as appropriate.Documents

13、Related to Lesson: N/AMission Directorate(s): Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-a71 Exploration Systemsa71 Sciencea71 Space Operationsa71 Aeronautics ResearchAdditional Key Phrase(s): a71 Flight Equipmenta71 Hardwarea71 Policy & Plannin

14、ga71 Risk Management/Assessmenta71 Safety & Mission Assurancea71 Softwarea71 Spacecrafta71 Test Articlea71 Test & VerificationAdditional Info: Approval Info: a71 Approval Date: 2001-05-17a71 Approval Name: Eric Raynora71 Approval Organization: QSa71 Approval Phone Number: 202-358-4738Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-