Hacker News Reader

Comment by ygra | Hacker News Reader

Well, common sense in a way would be enabled with assertions. But even if you know that you cannot be below ground, how would you recover? Your sensors clearly tell you that you're below ground, so what is the course of action? You have no way of knowing where you are, you just know that you don't know. It doesn't really change anything in the outcome. Sure, maybe you could go from altitude measurements to time measurements and most likely still leave a crater since it's not exact enough (there's a reason for the internal measurement instead of simpler ways, after all).

It would also require you to anticipate the malfunction in which case you already know that things like that could happen, in which case you'd likely determine how it could happen and how to avoid it and continue having useful data. Sounds to me like a better solution than trying to recover without data.

View on HN

From the article:

> This in turn successively triggered a premature release of the parachute and the backshell, a brief firing of the braking thrusters and finally activation of the on-ground systems as if Schiaparelli had already landed.

It would have been better to do nothing, in the hope that the altimeter data will resume to reasonable values, especially since the article mentions that the error is not supposed to last long:

> Its output was generally as predicted except for this event, which persisted for about one second – longer than would be expected.

There are several ways. First off, ignore the erroneous data. Then, estimate the altitude by other methods. As you mentioned, one way would be to integrate time and velocity.

All inputs and outputs should be run through sanity checks, with a plan for when they go wrong.

Essentially, when you've got a system that can't be fixed, plan for failure of each and every component (in isolation).

Cars do this, you can kill many sensors and an engine will still limp even with misfires. I guess consulting Bosch isn't an option tho

Some cars do this.

My friend's Honda literally stopped combustion when his battery died while driving (no, I have no idea how, but that was the diagnosis).

In contrast, I've limped my Miata along on alternator-only when the battery wouldn't hold a charge. Note: feathering the gas at a stop with brakes and clutch depressed to keep your spark from dying is an "interesting" experience.

At a stop pull the tranny out of gear and activate the parking brake.

More fun is driving a vehicle with no clutch: stalling at every stop and starting the motor in first gear, and shifting without clutching. I had to do that in my '83 280ZX in its last days.

Not necessarily very well; my cars' mass airflow sensor went out a few months back... the performance was all over the place and sudden engine stalls were frequent. You could kill the engine just by accelerating quickly when it was cold.

... and that was a single sensor out.

It helps that car engines don't really _need_ sensors to function. Cars existed before electronic sensors. A mars lander actually needs to know when to deploy parachutes.

If the lander cannot function without an altimeter, and there is only one altimeter with no backup plan, then you can plan to lose the lander.

This is not a new idea. Airplanes cannot fly without instruments, and all the instruments have backups and alternate means. Everything deemed "flight critical" has a backup alternative.

You'll find that fuel injectors don't work well without input from the MAF and O2 sensor(s).

True of modern EFI, but older mechanical fuel injectors did not have O2 sensors.

> your sensors clearly tell you that you're below ground

They weren't telling that. As far as I understood, the sensors were fully right, the software just hasn't expected the rotation to last "so long" -- the whole second, so it calculated the result wrong ("negative height") by incorrectly processing these multiple (in time) for their model unexpected inputs.

For context, the lander did have a radar altimeter. A radar altimeter has maximum distance from ground above which it will not establish a lock.

If radar altimeter had never had a lock, either the radar altimeter has faulted in a way you can't detect, or you are above the lock range for your radar altimeter.

If the radar altimeter had locked, you have a very accurate measurement of height above ground.

That's the surprising thing, though: "its radar Doppler altimeter functioned correctly and the measurements were included in the guidance, navigation and control system. "

And presumably mission time was in use too? Presumably they know to the (milli?)second when the lander should touchdown, at least from the point where the lander starts its descent. Time of flight send like a very strong, reliable signal?

Better to discard obviously bad data altogether. The system certainly should not act on that data, as seems to have been the case here.

I would argue that at 1700 km/h, even not acting is an action. The decision to do nothing is still a decision.

Reply on news.ycombinator.com