19 October 2016 — the European-Russian Schiaparelli lander crashed into the surface of Mars at 150 metres per second. It did not explode at launch, lose contact in space, or miss the planet. It entered the atmosphere exactly as planned, deployed its parachute, switched on its radar — and five minutes later decided it had already landed, though 3.7 kilometres still separated it from the surface.
Schiaparelli was never meant to search for life or drill into Martian soil. It was a technology demonstrator — a trial balloon ahead of the real ExoMars 2020 mission, which was supposed to deliver a rover to Mars. The European Space Agency and Roscosmos agreed on a two-stage programme: first, send the Trace Gas Orbiter to search for methane in the atmosphere, along with a small lander to test descent and landing.
Trace Gas Orbiter entered Mars orbit without trouble and is still operating today. Schiaparelli, meanwhile, was given one job: demonstrate that European engineers could land a spacecraft softly on Mars. Inside were only the bare minimum of scientific instruments — a weather station, several sensors, a camera. Its real value lay in the descent itself: the heat shield, the supersonic parachute, the radar altitude-determination system, and the braking thrusters meant to kill off the final metres of the fall.
The module weighed 577 kilograms. Power came from batteries good for a few days of operation. Communications went only through the orbiter, which had already flown away by the time of landing. There was no way to send the command: “stop, error.” The entire descent was handled by an autonomous system that had to get from 21,000 kilometres per hour to zero in six minutes.
19 October 2016, at 14:42:07 UTC, Schiaparelli slammed into the upper layers of the Martian atmosphere. Its heat shield heated to 1,500 degrees, aerodynamic braking brought its speed down to 470 metres per second — Mach 2.05, just over twice the speed of sound. At an altitude of roughly 11 kilometres, its 12-metre parachute deployed.
And that was when something began that the engineers had not accounted for in their calculations.
The parachute opened normally, but the module beneath it began to swing — much harder than the models had predicted. The craft swayed on its suspension lines, banking and righting itself at an angular velocity that simply did not exist in the simulations. This is called “parachute deployment dynamics,” and it is always unpredictable: turbulence in the thin Martian atmosphere, oscillations in the lines, the angle of the lines relative to the canopy — all of it combines into chaotic motion.
Inside Schiaparelli, an inertial measurement unit (IMU) was operating — a set of gyroscopes and accelerometers tracking the craft’s angular velocity and acceleration. A gyroscope measures how quickly the module rotates around each of its three axes. Every sensor has a limit: if the rotational speed exceeds the maximum value the instrument can register, saturation occurs — the sensor outputs a constant and raises a special flag: “I can’t go any further.”
Schiaparelli’s gyroscope hit its limit. The module was swinging too fast.
A descent-control system is an algorithm that integrates sensor readings and builds a picture of the world: where am I, where am I pointing, how fast am I moving, how high up am I. Inertial sensors are the foundation of that picture. The accelerometer tells it how velocity is changing. The gyroscope tells it how orientation is changing. The onboard computer takes those increments and adds them up over time, calculating its current position step by step.
When a gyroscope saturates, it stops providing correct angular-velocity values. Instead, it outputs the maximum value in its range and a flag: “data unreliable.”
The proper response to a saturation flag is to stop trusting that sensor’s readings until it recovers. You can switch to a backup IMU, use alternative sources — a star tracker, magnetometer, solar sensor — or simply “freeze” the orientation until the rotation slows and the flag clears.
Schiaparelli’s software did something else. It kept integrating the saturated velocity value into its estimate of orientation. The gyroscope was screaming: “I see the maximum, but I don’t actually know!” — and the algorithm replied: “Got it, logging that.”
The saturation lasted longer than the engineers had expected in ground modelling. The real dynamics of parachute deployment proved more aggressive than the simulations. Every second added new degrees to the orientation error. By the time the module finally stabilised and the saturation flag cleared, the onboard computer believed the craft had rotated 165 degrees from its actual position.
For the navigation system, that was a catastrophe: it projected radar and accelerometer measurements onto an inverted coordinate system.
At an altitude of around 7 kilometres, Schiaparelli jettisoned its heat shield and activated the RDA (Radar Doppler Altimeter). This Doppler radar measures distance to the surface and closing speed by sending a signal downward and analysing the reflected signal.
The radar itself was working properly and returning correct distances to the surface. The error came further down the chain.
The problem was that the GNC (Guidance, Navigation and Control) system used the orientation calculated from IMU data to determine where the radar beam was pointing. If the module is looking down, the radar gives altitude. If it is banked, the reading must be corrected for the angle.
But in the GNC data, the module was rotated by 165 degrees — nearly upside down. The algorithm took the correct radar measurement, applied an erroneous rotation matrix to it, and calculated a negative altitude. Roughly speaking, the system decided that if the radar showed 3.7 kilometres in the direction it considered “up,” then the module was already 3.7 kilometres below the surface of Mars.
In landing logic, that meant one thing: the landing was complete.
Schiaparelli’s control system followed a rigid sequence: parachute deployment → heat-shield jettison → radar activation → parachute and back-shell jettison → RCS braking thrusters ignition → soft landing. Each stage was triggered when certain conditions were met: velocity, altitude, time.
When GNC calculated a negative altitude, it decided it was time to move to the final stage. The module jettisoned its parachute and protective shell. The braking thrusters fired.
But the system also checked the criterion for shutting down the engines: if altitude was below a set threshold — meaning the craft was “already on the ground” — cut thrust. Since the calculated altitude was negative, that criterion triggered almost instantly. The engines ran for around 3 seconds and shut down.
The real altitude at that moment was 3.7 kilometres.
Schiaparelli was left without a parachute, without engines, in free fall. Mars has a thin atmosphere — about 1% as dense as Earth’s — so aerodynamic braking is minimal. The module simply fell, gaining speed.
At 14:47:28 UTC, it struck the surface at roughly 150 metres per second — 540 kilometres per hour. No soft landing. Total structural destruction.
For the first few hours after landing, uncertainty reigned at the European Space Agency. Trace Gas Orbiter had recorded the descent telemetry — but at those exact minutes, it was performing its main braking manoeuvre and entering Mars orbit. It did not downlink the stored data to Earth until morning, hours later. Mars Express and the GMRT radio telescope in India managed to record only the carrier signal, with none of the contents.
When engineers recovered the recorded descent data, it became clear that something had gone wrong. The signal had cut off too early. The engines had shut down seconds before their scheduled time. The algorithm had logged the final status in the telemetry: “landing complete.”
A few days later, NASA’s Mars Reconnaissance Orbiter photographed the presumed landing site. The images showed two objects: the parachute with the back shell, lying separately, and a dark spot a kilometre away — the impact site. No sign of an intact module. The spot measures approximately 15 by 40 metres, with a radial spray of soil spreading around it: the mark of a hard impact, not a landing.
Schiaparelli became a cloud of metal fragments on the surface of Meridiani Planum — the plain where the Opportunity rover once operated.
The accident investigation board released its report in May 2017. It listed the technical and systemic causes of the catastrophe, but at its centre was one fundamental miscalculation: the absence of a sanity check.
Schiaparelli’s onboard software included no FDIR (Failure Detection, Isolation and Recovery) mechanisms for critical stages of descent. The GNC algorithm never asked itself: “Can I even be three kilometres below the surface of a planet?” There was no simple check: if the radar reports a positive altitude and the integrated estimate is negative, one of the values must be wrong.
There was no fallback logic in case of IMU saturation. The saturation flag was raised, recorded in the telemetry, but had no effect on the navigation algorithm’s operation. The system kept integrating erroneous data as though it were reliable.
The modelling of parachute deployment dynamics proved insufficiently conservative. Engineers tested the system against calculated scenarios, but the module’s real behaviour in the Martian atmosphere went beyond those scenarios. Tests on Earth did not reproduce the conditions under which the IMU could saturate for so long.
Acceptance testing did not uncover the vulnerability. Perhaps because individual subsystems were tested rather than their interaction in extreme modes. Perhaps because the scenario of “prolonged IMU saturation plus erroneous radar projection” seemed too unlikely to build specifically into the tests.
The press often cites €1.3 billion as the “cost of ExoMars’s failure.” That is inaccurate. €1.3 billion was the budget for the entire ExoMars programme in 2008 prices, and it included both missions: Trace Gas Orbiter, Schiaparelli, and the planned second mission with the rover. ESA’s separate contract with Thales Alenia Space for the 2016 mission came to around €230 million — 146 of that went to the orbiter and lander, with the remainder allocated to rover work.
Trace Gas Orbiter, to repeat, is operational and carrying out its scientific programme studying methane and other gases in the Martian atmosphere. The loss of Schiaparelli did not devalue the entire mission, but specifically its final descent stage: engineers were left without data from it and without confirmation that the technology they had developed actually worked.
The second part of the programme — the Rosalind Franklin rover — was postponed. First to 2020, then to 2022, then to 2024. After Russia began its war against Ukraine in 2022, ESA severed cooperation with Roscosmos. The landing platform Russia had been developing was left without a mission — it had to be built again from scratch. In 2024, ESA reached an agreement with NASA on a launch vehicle, and in April 2026, the Americans named the specific rocket: Falcon Heavy. Launch is now scheduled for late 2028.
The Schiaparelli catastrophe does not look like a story about “a typo in one variable” or “a forgotten minus sign.” It is a story about systemic vulnerability: a spacecraft can have working engines, a functioning radar, and a reliable parachute, yet die because an algorithm puts too much faith in a single source of data.
Fault tolerance in space engineering is not just hardware redundancy. It is a system that constantly asks itself: “Does what I am seeing make sense?” The radar and inertial sensors must confirm one another. If their readings diverge, you need a third arbiter — or at least a pause before making a decision.
On Earth, you can restart the programme, send a patch, call an engineer. On Mars — you cannot. On 19 October 2016, the signal took almost ten minutes to travel from Mars to Earth, while the entire landing lasted less than six. An autonomous system must be paranoically distrustful of its own calculations.
Schiaparelli fell not because the hardware broke. It fell because the software did not doubt the impossible.