In August 2012, millions of Earthlings watched live as a hovering sky crane dropped the Curiosity rover onto the surface of Mars, 140 million miles away. Rocket scientist Adam Steltzner was on the front lines for that mission, and takes us behind the scenes in his new book, The Right Kind of Crazy: A True Story of Teamwork, Leadership and High-Stakes Innovation.
***
It’s just before 8 p.m. on August 5, 2012, and we’re nearing the climax of a massive team effort to land a rover the size of a MINI Cooper on Mars. The overall project, called the Mars Science Laboratory, has taken ten years to reach this point. Before we’re done tonight, we’ll have set that rover down gently at our selected site, or we’ll have made a smoking crater on the surface of Mars. Whichever way it goes, we won’t even know for seven minutes. That’s how long it takes data from Mars to reach us back on Earth.
Hunched over the desktop beside me is my good friend Miguel San Martin, who is also my deputy in managing our part of the project: the critical component known as Entry, Descent, and Landing (EDL).
The assignment we took on nearly a decade ago sounded straightforward enough: Design a way to deliver a 5,359-pound entry vehicle, which carries a 1,982-pound rover called Curiosity, into the Martian atmosphere without harm, then slow it down, guide it to the landing site, and put it down on the surface, safe and sound.
In just a couple of hours, we’ll know how well we did. It’s our all-or-nothing moment, the moment of truth.
Here’s how we needed it to work.
After the nearly nine-month journey of 354 million miles, our work has barely begun. First we have to convert the spacecraft from an interplanetary probe to an atmosphere-tolerating “aircraft.” We switch the lander’s electrical power from solar to nuclear. The spacecraft must be aligned at the proper angle to withstand 15 g’s in deceleration forces and temperatures of 3,800 degrees Fahrenheit when it smacks into the atmosphere of Mars.
About seven miles from the surface, friction with the atmosphere will have slowed the lander’s speed from 13,000 miles per hour to roughly 1,000. That’s when we pop the supersonic parachute. Twenty-four seconds later, we blow off the heat shield so the radar can see. A mile above the surface, we let go of our parachute and light our rockets to navigate to an altitude of 60 feet.
Then—and here’s the good part—comes the Sky Crane maneuver, in which the Curiosity rover is lowered out of its “rocket backpack” by a set of cables. The two objects, rover and backpack, separated by 25 feet of cable, then descend to the surface. We have to retract the cables right after touchdown, in real time, so they’ll stay taut as the module continues to descend at a little less than 2 miles an hour. At this point, small guillotines cut the cables and our rocket backpack, its job complete, flies a safe distance away and crashes into the surface, leaving the rover all alone and (we hope) ready to roll.
If any part of this scheme goes wrong—and all it takes is one failure from among tens of thousands of components to cause catastrophic loss—we’ll all look like idiots, and I’ll be at the head of the line.
So you can imagine that the entire EDL team was already pretty amped up and more than a little bit anxious well before we discovered the glitch.
It was Miguel San Martin who found it. In addition to helping me manage and lead the EDL team at a systems level, Mig served as chief engineer for Guidance, Navigation, and Control. About seventy-two hours ahead of entry, he discovered an error in our “center of navigation,” the point from which we make all measurements of dynamic motion. Our onboard computers conduct hundreds of thousands of calculations to determine just how fast the spacecraft is going and in exactly which direction, and they’re all based on that agreed-upon starting point. Mig noticed a tiny discrepancy in the measurements taken on the spacecraft from the value he expected. Which is not how it ought to be.
After doggedly digging into the discrepancy, he got down to the essence of the problem, which consisted of three numbers representing the three axes that located the center of navigation. It turned out that when our supplier, Honeywell, delivered the inertial measurement unit—the heart of the guidance system—a JPL guy made a mistake logging in those three numbers. Rocket science is a high-tech world, but it’s run by people, and people make mistakes.
During our spacecraft’s long flight, we had regularly scheduled meetings to discuss software parameters we might want to tweak as we approached Mars, including trajectory parameters. Dust storms on Mars are a nightmare, and at all times we have a roomful of people obsessing over atmospheric updates, not just for the landing site but for the entire planet, in case we need to fine-tune the flight path we come in on. These types of parameters we had planned on changing, and we had structured the software to make it easy and safe to do so.
Parameters more at the core of our software, like the center of navigation numbers Mig was looking at, were not in that set. We could change them, sure, but it was a risky proposition. When you’re a couple of days from the end of a nearly nine-month voyage, after nine years of development, you’re not eager to tamper with anything unless there’s a damn good reason. You certainly don’t blithely rejigger vital software parameters, because tinkering with something as simple as the date or time might inadvertently alter one of the thirty thousand other parameters and cause a catastrophe.
But now Mars is looming large in our windshield. We’ve made it this far, and we’ve landed successfully in all the simulations that contained the error, so does that mean we should live with that error? Should we alter the parameters, or should we let it ride?
Mig found the error Wednesday and had confirmed it by late Thursday night, August 2. We immediately set up a “tiger team” of about twenty-five specialists to drop everything and launch a full investigation of the anomaly response—spacecraft ops−speak for “Look into this and get it un-fucked-up if possible.”
On Saturday, August 4, we assembled, pencils down, for a come-to-Jesus session. While everyone found the error unsettling, no one argued for taking the risk to correct it.
We were still going around and around on the engineering analysis at 7 a.m. when the seven senior managers showed up. The top dog for the mission was Pete Theisinger, silver haired and slight of build but a tough fighter. I told him I hadn’t polled my team yet. “I’m happy to do it right now, in real time,” I added.
And so, with the senior decision makers looking on, we went around the table to get everyone’s best judgment. The poll-taking would end up with me.
Everyone said, “Steady as she goes.” Oddly enough, this included Miguel, who’d first spotted the problem and had obsessed about it until he got to the source.
Pete looked relieved with our group’s seeming endorsement of the status quo. He began to move the meeting toward closure. But then I stopped him.
“I said we’d poll the team,” I said. “Unfortunately, the team’s split . . . because I think we should make the change.”
I could see the anxiety tighten his face, and then he settled back to consider his options. The whole EDL team has said that we’re okay as is except for me, the guy in charge of that team, the guy specifically tasked with landing the spacecraft. I wasn’t an unassailable authority, but I was the one ass to kick.
Pete then polled his colleagues—the rest of the senior management team, including engineering leadership. One after another they echoed the tiger team, somewhat sheepishly admitting that they would rather not make the change, until we got to the last two guys: Richard Cook, the deputy project manager, and Rob Manning, the project chief engineer.
http://www.amazon.com/The-Right-Kind...
Richard said, “I agree with Adam. I think we have to make the change.”
Then Pete turned his eyes to Rob. “What say you, chief engineer?”
“I’m with Adam and Richard. We’ve practiced making these kinds of changes. Let’s do what we’ve practiced and make this right.”
Pete drew in a long breath, as if absorbing all the data that had been crunched in the past thirty-six hours, along with all the opinions expressed, leavened with fifty years of life experience. Then he said, “We’ll make the change. Prepare the command for transmission, and radiate the command.”
So just before 9 a.m. Saturday, thirty-nine hours after we’d begun our assessment, we altered the three numbers that pinpoint the center of navigation. Fourteen minutes later—the time required for a round-trip transmission between Earth and near Mars—the spacecraft reported back that the change had been received and the completed. At least as near as it could tell.
Had we just screwed the pooch, or had we averted an “O-ring moment” (the culprit behind the Challenger disaster) and saved the entire mission? There would be no way to know for thirty-six hours. During that time the spacecraft would have traveled 400,000 more miles and gone through the torturous seven minutes it would take for the rover to enter Mars’s atmosphere, descend to the surface, and land on the Red Planet safely—the Seven Minutes of Terror.
Excerpted from The Right Kind of Crazy: A True Story of Teamwork, Leadership, and High-Stakes Innovation, with permission of Portfolio, an imprint of Penguin Publishing Group, adivision of Penguin Random House LLC. Copyright © Adam Steltzner, 2016.
Top image: NASA engineers celebrate the successful landing of the Curiosity rover in 2012. Credit: Caltech/JPL.
