NASA’s Phoenix Mars Lander bears the mythical moniker of the bird “reborn in flames” for good reason. It’s not the probe itself that has risen from the dead, but its hardware design and its operational philosophy.
The last time this spacecraft design reached Mars, in December 1999, it vanished into flames and never reappeared. Its fate remains a mystery — and that mystery remains a gnawing anxiety for space officials.
This mission also brings back to life, just in time, the technique of soft landing on another world by throttled rocket thrust. Such a maneuver hasn’t been done anywhere else in the solar system for more than 30 years, but it’s a critical strategy for the heavy Mars rover that NASA plans to land at the end of this decade.
The Phoenix spacecraft, due for launch early Saturday, was constructed from backup hardware left over from Mars Polar Lander, the probe that met its doom in 1999. NASA didn’t realize until after Mars Polar Lander's launch that the spacecraft had been built with too many shortcuts on too tight a budget, and that too many critical reviews and tests had been skipped.
Even before Mars Polar Lander reached Mars, space officials had realized that it was probably hopeless to expect it to work. And it didn’t. It was last heard from checking in prior to entering the Martian atmosphere in early December 1999, and then ... unbroken silence. Even searches in later years with better and better orbiting cameras failed to locate its wreckage so as to gather clues, however subtle, as to its fate.
The year 1999 was a bad one for Mars exploration. Following the September loss of the Mars Climate Orbiter — which was primarily due to management errors, and not the over-hyped confusion over metric vs. English measurement units — NASA initiated a crash review of the Mars Polar Lander, even while it was still in flight, to identify any similar oversights.
"Major errors in the propulsion thermal design went undetected until after launch," the report stated after only several weeks of work. The engine designs alone "did contain four potentially serious, if not catastrophic, weaknesses."
Based on this analysis — which needed to be completed before the scheduled December arrival of the lander — NASA implemented workaround procedures. But they didn't catch another flaw in the control software that, more likely, would make it crash. And the possibility that there were even more undiscovered flaws couldn’t be ruled out, then or since.
The flaw they fixed had to do with the thrusters getting too cold on the long cruise to the target planet. The engines, adapted from a military missile warhead (a fact never disclosed by NASA), hadn’t been tested at the actual temperatures predicted for arrival. As a result, their startup pulses might thermally shock their engines, cracking them. To reduce this chance, electrical heaters were turned on for as long as battery power allowed, after which the engineers hoped for the best.
One flaw they didn’t fix was only discovered two months after the probe’s disappearance, and entirely by accident. This occurred during checkout of the backup hardware that now, eight years later, forms the basis of the new probe. Contact sensors in the landing legs, designed to turn the engine off at touchdown, also had the unintended habit of sometimes being triggered by the legs’ spring-loaded swing into the open position once the heat shield was jettisoned. With the ‘contact flag’ set falsely, the software would turn the thrusters off during descent, at too high an altitude for a survivable free fall.
That flaw, and others, have been fixed in Phoenix, and classic NASA reliability analyses have been rigorously applied. But there remains some doubt, because verification of the role of the previous flaws remains elusive. After all, a panel of experts headed by former NASA official Thomas Young said they were able to identify 31 different "plausible failure modes" after only a few weeks of study.
If either of the two discovered failure modes had occurred in 1999, engineers believe that by now the probe’s wreckage (and the crater it dug) would have been spotted by the high-resolution cameras on scout spacecraft that followed. The continuing failure to see traces of the 1999 crash opens the haunting possibility that an entirely different design flaw could have doomed Mars Polar Lander somewhere else along its long landing sequence. If so, that flaw may have been — and might still be — unrecognized and unrepaired.
So next spring it will be a real nail-biter when Phoenix tries to “come back to life,” overcome its past, and emerge alive from the flames.