Negative Altitude, Underground — JavaScript Bug Hunt

Briefing

Modelled on the Schiaparelli lander (October 2016): the inertial unit saturated during parachute deployment and reported a rotation rate far beyond its range. The navigation filter integrated that value, concluded the lander was below ground level, and jettisoned the parachute and shut off the thrusters at about 3.7 km altitude.

navfilter.js integrates every sample it is handed, saturated or not.

Fix estimateAltitude so saturated samples are discarded and the estimate can never go negative.

Bug report

BUG-EDM16 · Priority: Critical · Reported by: GNC

estimateAltitude(start, samples, maxRate):

• integrates each sample's rate (metres lost per step)
• a sample whose |rate| exceeds maxRate is SATURATED and must be discarded, with the previous accepted rate used in its place (0 if there is none)
• the returned altitude is clamped to a floor of 0

Observed: one saturated sample drives the estimate to a large negative altitude and the descent sequence fires early.

Logs

[gnc] altitude=-2400.0 after sample rate=98000.0 (max 500.0)
[gnc] parachute jettisoned at true altitude 3.7km

The code as shipped

src/gnc/navfilter.js (editable)

// Integrates descent rates into an altitude estimate.
exports.estimateAltitude = function (start, samples, maxRate) {
  var altitude = start;
  for (var i = 0; i < samples.length; i++) {
    altitude = altitude - samples[i].rate;
  }
  return altitude;
};

Read-only context: src/gnc/IMU.js.