Touchdown at Forty Metres — JavaScript Bug Hunt

Briefing

Modelled on the Mars Polar Lander loss (December 1999): the leg-deployment jolt produced a spurious touchdown signal. The flight software latched that transient as "landed" and shut the descent engine down about 40 metres up. The lander fell.

descent.js latches the touchdown flag the moment it first sees it.

Fix shouldCutEngine so a transient during leg deployment cannot latch, and touchdown is only believed once it is stable and the altitude agrees.

Bug report

BUG-MPL · Priority: Critical · Reported by: EDL team

shouldCutEngine(samples, altitude, legDeploymentEndsAt) must return true only when BOTH hold:

• the last 3 samples all read touchdown=true, and none of those samples has an index below legDeploymentEndsAt (transients during deployment are ignored)
• altitude is at or below 2 metres

Observed: one true sample anywhere in the record latches the state and the engine is cut, whatever the altitude.

Logs

[edl] engine cut at altitude=40.1m
[edl] touchdown asserted at sample 3 (leg deployment ends at sample 12)

The code as shipped

src/edl/descent.js (editable)

// Decides whether the descent engine may be shut down.
exports.shouldCutEngine = function (samples, altitude, legDeploymentEndsAt) {
  var latched = false;
  for (var i = 0; i < samples.length; i++) {
    if (samples[i].touchdown) latched = true;
  }
  return latched;
};

Read-only context: src/edl/SEQUENCE.js.