Computer glitch led to Mars Global Surveyor's demise

Computerworld - Computer coding errors apparently caused the loss of the U.S. National Aeronautics and Space Administration's Mars Global Surveyor (MGS) orbiter spacecraft last year.

That was the conclusion of a preliminary report from an internal review board earlier this month, NASA announced. The MGS was launched in November 1996 and started its Mars orbit the following September as part of what became a nearly 10-year-long scientific survey.

The MGS mapped the surface and atmosphere of Mars, provided extensive images of the planet and even assisted in locating a landing spot for other spacecraft. Its last communication with Earth was on Nov. 2, after the orbiter was ordered to perform a routine adjustment of its solar panels. It responded by reporting a series of alarms, then indicated it had stabilized itself. That was its final message to Earth.

NASA assumed that within 11 hours of that transmission, depleted batteries had left the craft unable to control its orientation in the Mars orbit. On Jan. 28, the MGS was declared lost and efforts to recover it ended.

On April 13, the agency announced that the most likely cause of the failure was coding related. "The loss of the spacecraft was the result of a series of events linked to a computer error made five months before the likely battery failure," Dolly Perkins, the internal review board chairwoman, said in a statement. Perkins is also deputy director-technical of the NASA Goddard Space Flight Center in Greenbelt, Md. Her committee, charged with both finding out what happened and how to prevent similar losses in the future, issued a technical report on the incident (download PDF).

According to the report, the malfunction resulted from faulty code uploaded to the MGS in June 2006. During a software upgrade to the MGS command system, performance settings were sent to the wrong computer memory addresses on the spacecraft. This caused the Nov. 2 malfunction when, after being unable to properly control the adjustment of its solar panels, the MGS went into contingency mode. In doing so, erroneous data led it to orient itself so that one of its two batteries was exposed to direct sunlight.

The spacecraft's power management program interpreted the overheating of the battery as an overcharge and prevented it from recharging. The other battery was unable to recharge adequately and they both eventually were drained of power. Another software error repositioned an antenna, cutting off contact with Earth and leaving ground control personnel in the dark about the MGS's thermal and power problems.

As the report noted, this was caused in part by a design error. "The onboard fault protection was insufficient to handle the faults that were most likely encountered. The spacecraft mistakenly determined that a solar array was stuck and, based on this information, went to an altitude that was thermally unsafe for one of its batteries."

The space agency later boasted that the mission lasted four times longer than expected, with the MGS proving to be the most valuable of all spacecraft sent to the red planet.

"Mars Global Surveyor has surpassed all expectations," Michael Meyer, NASA's lead scientist for Mars exploration, said in a Nov. 21 statement after contact with the craft was lost. "It has already been the most productive science mission to Mars, and it will yield more discoveries as the treasury of observations it has made continues to be analyzed for years to come."

Read more about software in Computerworld's Software Knowledge Center.