Apparently the lander was moving around too much. Shaking, swinging under the parachute or something like that. The IMU went out of its measurement range and reported incorrect values for 1 second.
The incorrect values led the guidance system to calculate a negative altitude, which led to the conclusion Schiaparelli had landed when it was in fact still more than 3 km up.
From the ESA investigation:
As Schiaparelli descended under its parachute, its radar Doppler altimeter functioned correctly and the measurements were included in the guidance, navigation and control system. However, saturation – maximum measurement – of the Inertial Measurement Unit (IMU) had occurred shortly after the parachute deployment. The IMU measures the rotation rates of the vehicle. Its output was generally as predicted except for this event, which persisted for about one second – longer than would be expected.
When merged into the navigation system, the erroneous information generated an estimated altitude that was negative – that is, below ground level. This in turn successively triggered a premature release of the parachute and the backshell, a brief firing of the braking thrusters and finally activation of the on-ground systems as if Schiaparelli had already landed. In reality, the vehicle was still at an altitude of around 3.7 km.
The final report has been released:
THE CIRCUMSTANCES OF THE ANOMALY
The sequence (timeline) of the events is reported below with respect to UTC time.
a) Separation from TGO on 16/10/2016 at 14:42:00.
b) Awakening from hibernation on 19/10/2016 at 13:29:48.
c) Entry in the Mars atmosphere (EIP) detected at 14:42:22 through accelerometers.
d) Between EIP and Parachute Deployment triggering, an unexpected evolution in the spin rate of the EDM was noticed.
e) At 14:45:23 the parachute deployment was triggered (trigger is the g-level). - The dynamic conditions at the moment of parachute deployment derived from telemetry showed a total angle of attack (AOA) estimated of about 6.5 deg and a lateral angular rate < 3 deg/s
f) Parachute deployment time (time from mortar firing to peak load factor) was circa 1 sec (in line with the predictions).
- The parachute was deployed, and the parachute inflation triggered some oscillations of Schiaparelli at a frequency of approximately 2.5 Hz.
- About 0.2 sec after the peak load of the parachute inflation, the IMU measured a pitch angular rate (angular rate around Z-EDM axis) larger than expected.
- The IMU raised a saturation flag,.
- During the period the IMU saturation flag was set, the GNC Software integrated an angular rate assumed to be equal to the saturation threshold rate. The integration of this constant angular rate, during which the EDM was in reality oscillating, led to an error in the GNC estimated attitude of the EDM of about 165 degrees. This would correspond to an EDM nearly turned downside up with the front shield side pointing to quasi-zenith.
- After the parachute inflation, the oscillatory motion of Schiaparelli under its parachute was mostly damped and Schiaparelli was descending at a nominal descent rate, with very small oscillations (< 3 deg) around pitch and yaw axis.
- After parachute inflation the angular acceleration around the spin axis changed again
g) The Front Shield was jettisoned as planned 40s after parachute deployment (timer based command) at 14:46:03
h) The RDA was switched on at 14:46:19 (15s after Front Shield separation acknowledgment) and provided coherent slant ranges, without any indication of anomalies;
- Once the RDA is on, RIL mode, “consistency checks” between IMU and RDA measurements are performed. The parameters checked are: delta velocity and delta altitude. The altitude is obtained using the GNC estimated attitude to project the RDA slant ranges on the vertical.
- Because of the error in the estimated attitude that occurred at parachute inflation, the GNC Software projected the RDA range measurements with an erroneous off-vertical angle and deduced a negative altitude (cosinus of angles > 90 degrees are negative). There was no check on board of the plausibility of this altitude calculation
i) Consequently the “consistency check” failed for more than 5 sec. after which the RDA was forced anyway into the loop based on the logic that landing was impossible without the RDA. The correctness of the other contributor to the altitude estimation, i.e. the attitude estimate, was not put in question. The RDA was put in the loop (event signalled by RIL time-out flag at 14:46:46).
- The GNC mode entered was TERMINAL DESCENT where the altitude is scrutinized to release the Back-Shell and parachute if the altitude is below an on board calculated limit. EXOMARS 2016 - Schiaparelli Anomaly Inquiry Reference: DG-I/2017/546/TTN Date 18/05/2017 Issue 1 Rev 0 Page 13 - Because of the incorrect attitude estimation leading to an estimated negative altitude, the GNC Software validated the conditions for separating the back-shell and parachute
j) Back-shell separation at 14:46:49.
k) Switch-on of the Reaction Control System (RCS). - First RCS thruster operation was at 14:46:51 (no backshell avoidance manoeuvre)
l) Switch-off of the RCS 3 seconds later at 14:46:54.
- The criterion for the RCS switch-off was based on the estimation of the EDM energy (as combination of the altitude and vertical velocity) being lower than a pre-set threshold. Since the estimation of the altitude was negative and very big, the negative potential energy was much higher than the positive kinetic energy (square of the velocity) and this criterion was immediately satisfied the RCS was commanded off as soon as allowed by the thruster modulation logic. This occurred just 3 seconds after the RCS switch on command when the capsule was at an altitude of about 3.7 km, leading to a free fall of Schiaparelli and to the impact on Mars surface about 34 seconds later. m) The Touch Down occurred at 14:47:28 corresponding to the crash of the surface platform on the surface of Mars at an estimated velocity of ≈150 m/s. The expected landing time was 14:48:05 (some 37s later).