In-Flight Anomaly

Surviving an In-Flight Anomaly: What Happened on Ingenuity’s Sixth Flight

Written by Håvard Grip

On the 91st Martian day, or sol, of NASA’s Mars 2020 Perseverance rover mission, the Ingenuity Mars Helicopter performed its sixth flight. The flight was designed to expand the flight envelope and demonstrate aerial-imaging capabilities by taking stereo images of a region of interest to the west. Ingenuity was commanded to climb to an altitude of 33 feet (10 meters) before translating 492 feet (150 meters) to the southwest at a ground speed of 9 mph (4 meters per second). At that point, it was to translate 49 feet (15 meters) to the south while taking images toward the west, then fly another 164 feet (50 meters) northeast and land.

Telemetry from Flight Six shows that the first 150-meter leg of the flight went off without a hitch. But toward the end of that leg, something happened: Ingenuity began adjusting its velocity and tilting back and forth in an oscillating pattern. This behavior persisted throughout the rest of the flight. Prior to landing safely, onboard sensors indicated the rotorcraft encountered roll and pitch excursions of more than 20 degrees, large control inputs, and spikes in power consumption.

How Ingenuity estimates motion

While airborne, Ingenuity keeps track of its motion using an onboard inertial measurement unit (IMU). The IMU measures Ingenuity’s accelerations and rotational rates. By integrating this information over time, it is possible to estimate the helicopter’s position, velocity, and attitude (where it is, how fast it is moving, and how it is oriented in space). The onboard control system reacts to the estimated motions by adjusting control inputs rapidly (at a rate of 500 times per second).

If the navigation system relied on the IMU alone, it would not be very accurate in the long run: Errors would quickly accumulate, and the helicopter would eventually lose its way. To maintain better accuracy over time, the IMU-based estimates are nominally corrected on a regular basis, and this is where Ingenuity’s navigation camera comes in. For the majority of time airborne, the downward-looking navcams takes 30 pictures a second of the Martian surface and immediately feeds them into the helicopter’s navigation system.  Each time an image arrives, the navigation system’s algorithm performs a series of actions: First, it examines the timestamp that it receives together with the image in order to determine when the image was taken. Then, the algorithm makes a prediction about what the camera should have been seeing at that particular point in time, in terms of surface features that it can recognize from previous images taken moments before (typically due to color variations and protuberances like rocks and sand ripples). Finally, the algorithm looks at where those features actually appear in the image. The navigation algorithm uses the difference between the predicted and actual locations of these features to correct its estimates of position, velocity, and attitude.

Approximately 54 seconds into the flight, a glitch occurred in the pipeline of images being delivered by the navigation camera. This glitch caused a single image to be lost, but more importantly, it resulted in all later navigation images being delivered with inaccurate timestamps. From this point on, each time the navigation algorithm performed a correction based on a navigation image, it was operating on the basis of incorrect information about when the image was taken. The resulting inconsistencies significantly degraded the information used to fly the helicopter, leading to estimates being constantly “corrected” to account for phantom errors. Large oscillations ensued.

Surviving the anomaly

Despite encountering this anomaly, Ingenuity was able to maintain flight and land safely on the surface within approximately 16 feet (5 meters) of the intended landing location. One reason it was able to do so is the considerable effort that has gone into ensuring that the helicopter’s flight control system has ample “stability margin”: We designed Ingenuity to tolerate significant errors without becoming unstable, including errors in timing. This built-in margin was not fully needed in Ingenuity’s previous flights, because the vehicle’s behavior was in-family with our expectations, but this margin came to the rescue in Flight Six.

Another design decision also played a role in helping Ingenuity land safely. As I’ve written about before, we stop using navigation camera images during the final phase of the descent to landing to ensure smooth and continuous estimates of the helicopter motion during this critical phase. That design decision also paid off during Flight Six: Ingenuity ignored the camera images in the final moments of flight, stopped oscillating, leveled its attitude, and touched down at the speed as designed.

Looking at the bigger picture, Flight Six ended with Ingenuity safely on the ground because a number of subsystems – the rotor system, the actuators, and the power system – responded to increased demands to keep the helicopter flying. In a very real sense, Ingenuity muscled through the situation, and while the flight uncovered a timing vulnerability that will now have to be addressed, it also confirmed the robustness of the system in multiple ways.

While we did not intentionally plan such a stressful flight, NASA now has flight data probing the outer reaches of the helicopter’s performance envelope. That data will be carefully analyzed in the time ahead, expanding our reservoir of knowledge about flying helicopters on Mars.