How did NASA avoid a repeat of the Mars Polar Lander failure?

Question

One of the most likely causes of the MPL (Mars Polar Lander) crash landing on Mars was the deployment of the legs being mistaken by the onboard computer as touchdown. Phoenix (and later InSight) essentially used the same Lockheed platform as the MPL. How did they avoid the error that caused the MPL to crash in those subsequent missions?

Answer 1

The failure analysis report includes a large laundry list of recommendations to prevent a repeat failure. As usual in these reports, corrective actions are listed for potential causes that were found during the investigation that may have not contributed to the actual in-flight failure. The second bullet under Software is a reference to the suspected actual cause.

The recommendations for the Mars "01 Lander are:

Communications

• Add EDL communications.
• Add low-gain transmit antenna.
• Perform an ionization breakdown test of the medium-gain and UHF antennas in a landed 6-torr environment.
• Conduct an end-to-end UHF verification test between the lander and both the '01 and MGS orbiter configurations.

Propulsion and Thermal

• Ensure that tank outlet and line temperatures are maintained well above the freezing point of hydrazine.

• Ensure acceptable operating temperatures for the thruster inlet manifolds and catalyst beds.

• Ensure that propellant valve temperatures are monitored during flight.

• Limit propellant migration between tanks to acceptable levels during all mission phases.

• Perform a high-fidelity, closed-loop dynamic propulsion test with at least three live engines and flight-like plumbing support structure.

• Evaluate the water hammer effect on the thrusters, structures, and controls due to 100-percent duty cycle thrusters.

• Conduct plume-soil interaction analysis or test.

Software

• Ensure compliance with existing flight software review and lest procedures.
• Fix known software problems-- e.g.. landing leg touchdown false indication: singularity at zero descent velocity (gravity turn orientation): Radar data lockout: parachute deployment trigger algorithm (count up as well as count down): parachute separation algorithm (whether parachute or thrusters provide more deceleration): ground-detection algorithm (possible false detection of heatshield).
• Fix and validate post-landing fault-recovery algorithm and sequences.

Structures and Mechanisms

• Validate center-of mass properties of lander.

• Stiffen support structure for propulsion feed lines.

• Perform heatshield ATLO system first-motion separation test.

Controls

• Ensure through analysis, simulation, and testing that the control system has adequate authority and stability margins.

Operations

• Resolve small-forces discrepancies.
• Improve TCM-5 flexibility for improved landing site control.

Miscellaneous

• Modify Radar to reduce sensitivity to slopes.
• Review key triggers in EDL sequence to improve robustness.
• Perform an analysis to determine that the probability of the parachute draping over the lander is acceptably low.

Acronymology:

• ATLO - Assembly, Test, Launch Operations
• EDL - Entry, Descent and Landing
• MGS - Mars Global Surveyor
• TCM - Trajectory Correction Maneuver