by The Design
each general-purpose heat source module. The core of the MMRTG is a stack of eight of
these modules, and the core is surrounded by an aluminum alloy housing. In the event of
a launch accident at high altitude, the aluminum housing would melt, which would scatter
the eight modules. Those lower-mass modules would have lower terminal velocities than
the whole MMRTG. At their lower velocities, the carbon fiber aeroshells wouldn’t melt
upon reentry. Even if the pellets are subjected to large enough forces to break them, their ceramic form means they’ll break into large chunks rather than a dust that could be
inhaled.2
To turn the heat from the MMRTG core into power, the safely constructed, hot core is
encased in a graphite heat distribution block. Then comes a layer of thermoelectric mod-
ules, their hot shoes in contact with the heat distribution block and their cold shoes touching the outer shell of the MMRTG and its heat-radiating fins. The hot shoes operate at a
temperature of 520°C, the cold shoes at a still-toasty 75°C during cruise and 150–185°C
on Mars, depending on the season.3
2 NASA Science Mission Directorate (2006)
3 Woerner et al (2013), Woerner et al (2012)
4.2 Power System and MMRTG 143
Figure 4.5. Parts of the Multi-Mission Radioisotope Thermoelectric Generator (MMRTG).
Emily Lakdawalla after Woerner et al (2012 ).
144 How the Rover Works
The MMRTG is not very efficient at turning heat into electricity. When first fueled, the
thermocouples converted about 110 watts to electricity. The rover’s heat rejection system
uses some of the remaining 1900 watts of heat to keep the warm electronics box warm
(more on that in section 4.3); the rest of the heat radiates away into the Martian air.
The rover requires 45 to 70 watts of that power at all times while sleeping. 4 It consumes at least 150 watts whenever it is awake, and up to 500 watts while driving. Therefore, the
rover is completely dependent upon its batteries and spends most of its time asleep and
recharging. It is active for about 6 hours of each Martian day, on average.5
4.2.2 Performance on Mars
Upon landing, the MMRTG generated about 114 watts, ranging from 109 to 119 watts
over the course of the sol. You might have noticed that this is more power than it generated when it was first fueled, while on Earth. The MMRTG was designed to operate at the lower
ambient temperature on Mars, where there is a higher contrast in temperature between the
hot and cold shoes of the thermocouples. It generates more power at night, when ambient
temperatures are lowest.
Over time, the performance of the MMRTG decays at a rate of roughly 1 watt per 80 sols.
The plutonium decay is exponential – it declines more slowly as time goes on – but the
MMRTG performance decay is close to linear. That’s because the thermocouples are also
degrading, but unlike the plutonium they degrade faster with age. At the beginning of the mission, engineers estimated that the MMRTG would still be producing 54 watts 17 years after
was fueled, on October 28, 2025, which would correspond to sol 4702.6 Even with efficiency improvements, the rover’s activity will be increasingly energy-constrained with time.
4.2.3 Anomalies
On sol 456 (November 17, 2013), the rover experienced a partially conductive “soft short”
in the MMRTG, apparently caused by a part of the electrical power circuit touching the
aluminum housing.7 The Cassini spacecraft had MMRTGs of the same design, and experienced similar shorts. As a result of the short, the voltage difference between the rover’s power bus and chassis changed (from 11 volts to 4 volts on that particular sol). The rover’s power system is robust to such changes in voltage, having been designed with a floating
bus. The mission halted activity for 6 sols to investigate the problem, which had spontane-
ously disappeared by sol 461. 8 It occurred again on sols 816, 1084, and 1158, and has been happening more frequently since. The soft short is annoying because it halts operations,
but it does not threaten the health of the rover.9 Table 4.1 lists all the soft shorts to sol 1582.
4 Gross and Cardell (2011)
5 Welch et al (2013)
6 Woerner (2014)
7 JPL (2013a)
8 JPL (2013b)
9 David Woerner, personal communication, email dated June 16, 2016
4.3 Avionics 145
Table 4.1. Dates and effects of Curiosity MMRTG soft shorts to sol 1582. Courtesy Steven Lee.
Sol
End Sol
Sols Since Prior Short
Character of Short
456
461
n/a
Intermittent, then Constant
816
835
355
Intermittent
1084
1090
249
Intermittent
1158
1166
68
Constant
1173
1181
7
Constant
1187
1191
6
Intermittent
1204
1221
13
Intermittent, then Constant
1233
1239
12
Constant
1247
1256
8
Constant
1257
1269
1
Intermittent, then Constant
1284
1288
15
Intermittent, then Constant
1288
1289
1
Constant
1338
1362
50
Intermittent
1373
1422
11
Intermittent
1445
1461
23
Intermittent
1473
1495
12
Intermittent
1530
1582
35
Intermittent, then Constant
4.3 AVIONICS
The rover has two redundant sets of avionics controlling all of its functions, referred to as the A-side and B-side. 10 Each side has three main processor units. Two redundant rover power analog modules (RPAMs) function like the rover’s cerebellum, controlling all of its
essential life support functions: power distribution, system fault protection, and wakeups/
shutdowns. The rover compute elements (RCEs) are like the rover’s cerebrum, controlling
its higher functions. The rover motor control assembly (RMCA) is like the rover’s motor
cortex, controlling all motion of wheels, arm, turret, antenna, mast, and instrument covers.
Both A-side and B-side power modules are interconnected with both A-side and B-side
computers, as are the two cooling system pumps, two radio transceivers, two inertial mea-
surement units, and individual science instruments. It’s easy to see why testing of the
avionics was so time-consuming and challenging: just those four pairs of redundant com-
ponents yield 16 possible configurations.
Because the rover spends most of its time asleep in order to conserve power, it performs
wakeups and shutdowns several times per sol. Before the computer shuts down, it sets a
countdown timer in the power module; when the timer expires, the power module turns on
the main computer again. One function that is partially available even while the rover is
asleep is co
mmunications. An orbiter can hail Curiosity through a transceiver, requesting
the sleeping rover to wake up. This capability would only be needed if the rover lost its
clock timing, so did not know when communications passes would occur.11
10 Lee and Donaldson (2013)
11 Makovsky et al (2009)
146 How the Rover Works
4.3.1 The sol 200 anomaly
On sol 200 (February 27, 2013), the rover sent telemetry to Earth indicating problems in its flash memory on the rover compute element. The memory problems had caused several software tasks to hang, preventing the rover compute element from performing the planned shut
down for that day. The software should have handled the memory loss gracefully: onboard fault protection watchdog timers should have caught the issue and placed the rover in a safe state.
But the watchdogs were being pacified without actually triggering a safe mode. Without the
ability to shut down, the rover could have drained its batteries in three to six days. 12 As the anomaly investigation continued that afternoon, Earth testing revealed that the next time the rover attempted to communicate with Earth, that process would hang, and the computer would
shut off the radio, which could leave operators without the ability to command the rover.13
The mission asked for emergency time on the Deep Space Network to send a series of
commands to the rover to swap to the backup computer, just in time before the rover’s radio would be powered off. After 2:00 in the morning in California, or about 8:00 in the morning local time for Curiosity, after both the engineers and the rover had had totally sleepless
nights, the signal was sent. Curiosity sent a signal back indicating that the computer swap had been successful, but the signal arrived a heart-straining 3 minutes later than expected.
Subsequent investigation revealed that the problem originated in a single bad chip in
the A-side computer’s flash memory array. They worked around the problem by instruct-
ing the A-side computer not to use half of its flash memory. Fortunately, there was plenty
of margin available. The software was updated to handle these conditions more gracefully.
The rover has used the B-side rover compute element as its primary computer ever since.
Engineers patched the flight software to return the A-side computer to service as a reliable backup after sol 772.
4.3.2 Flight software
Each of the rover compute elements has a 133 megahertz RAD750 processor running the
VxWorks operating system, 256 megabytes of RAM, and 4 gigabytes of flash data storage.
(Smartphones in common use at the time of launch operated at about four times the speed
with four times the storage.)14 The rover’s flight software includes many autonomous functions to reduce the workload of daily tactical planning. For example, communications
windows are scheduled long in advance; an occasionally updated table in rover memory
keeps track of all such windows, and the rover automatically executes communications
passes within those windows, even if it has to wake itself up to do so.
The rover’s autonomy has increased over time, thanks to several flight software
upgrades. It takes many sols to uplink new software to the rover, and then a minimum of
four sols to verify, install, and commit the new software on both of the rover computers.
Each of the instruments also has its own flight software, which can be upgraded indepen-
dently of the main flight software. 15
12 JPL (2014)
13 Magdy Bareh, personal communication, August 28, 2017
14 Davis (2012)
15 Danny Lam explained the upgrades to me in an email on April 4, 2017
4.3 Avionics 147
4.3.2.1 Flight software version R10.5.8 (sol 8)
The rover landed running version R9 of its flight software (specifically, version R9.4.7).
Immediately after landing, the rover upgraded to version R10.5.6, which removed
many of the cruise functions and added in many surface operations functions. When
they transitioned to version R10.5.6, they followed by patching the new software to fix
a potential problem with the X-band radio transponder, and the rover ran version
R10.5.8 for some time.
4.3.2.2 Flight software version R11.0.4 (sol 484)
A bit more than a year after landing, as the rover was traveling between Cooperstown and
the Kimberley, the engineers began to uplink version R11.0.4. The upgrade actually failed
to complete on the first attempt, but finished successfully on sol 484 (see section 3.5.3).
Version R11 had a number of improvements, new features, and bug fixes that increased
operational efficiency:
• New autonomy to track certain types of unsuccessful data transmission attempts,
allowing it to reattempt transmission without being commanded to, saving time for
tactical planners.
• Dramatic improvements to data compression, allowing more data to be downlinked
in a given pass.
• Improvements to fault protection logic in the event of multiple sequential switches
between A and B side computers.
• “Dream mode” ability to initiate heating of rover motors while still asleep.
• Temperature-dependent camera models for the Navcams (necessary for visual
odometry and autonomous navigation, see sections 3.5.3 and 6.5) became part of
onboard rover software rather than being sequenced from the ground each time.
• Improvements to multi-sol driving capability, including the ability to save on-board
terrain maps during sleep so the rover can use the same one to continue a drive the
next day without regenerating it, allowing the rover to spend more time driving.
• Several improvements intended for drilling while parked on a slope: new ability to
steer wheels one at a time, improving steering stability on slopes; visual odometry
during arm operations, allowing slip checking (see section 6.4.3) when drilling on slopes.
• Lots of efficiency, fault protection, and system robustness improvements for sam-
ple operations, making both Mars operations and ground planning more efficient.
• Added ability to adjust ChemCam focus position to produce Z-stacks as a single
command, making sequencing less onerous.
“Dream mode” was an especially important improvement to the rover’s efficiency dur-
ing colder winter months. 16 The first activity of the day often requires preheating motors before they can be used, which can take up to two hours. To have the rover computer
16 Lee and Donaldson (2013)
148 How the Rover Works
powered on and waiting for motor warmup consumes precious energy that would other-
wise be available for driving or science. Dream mode solved this problem. To prepare for
dream mode, before shutdown, the rover computer delivers a heater schedule to the power
analog module. If any preheating is scheduled to begin before rover wakeup, the power
analog module can command the heater to turn on while the rover is otherwise asleep. In
dream mode, the rover is also capable of checking temperature sensors once an hour while
asleep. Although it was in development since before landing, dream mode wasn’t actually
used operationally until sol 1180, shortly before the rover’s second winter solstice.
4.3.2.3 Flight software version R11.0.5 (sol 772)
In October 2014, engineers patched R11.0.4 to R11.0.5 to permanently resolve the prob-
lem with the A-side computer that had existed since the sol 200 anomaly. The patch,
appli
ed only to the A-side computer, instructed it not to read its bad memory cells, and
gave the rover a fully functional backup computer again.
4.3.2.4 Flight software version R12.0.3 (sol 879)
In January 2015, they upgraded to version R12. Its improvements were more modest than
R11’s:
• Ability to use inertial measurement units to sense slipping during drilling opera-
tions on slopes.
• Other improvements to driving that made the guarded mode easier to sequence.
• Added “hooks” into the flight software that made it easier to add a new ability in the
future without a complete flight software upgrade. The hooks were for software
added in 2017 that permitted traction control, in which wheels can be driven at dif-
ferent speeds when certain conditions are met, in order to allow wheels going over
obstacles to travel faster than other wheels.
4.4 THERMAL CONTROL
Maintaining the temperature of a spacecraft’s components within allowable ranges pres-
ents challenges for any mission. Space is cold; the Sun is hot; a vacuum doesn’t conduct
heat. Mars has a thin atmosphere that mitigates the temperature swings that would occur
in a vacuum, but not as well as Earth’s does.
Curiosity’s external parts can handle temperatures as high as 50°C and as low
as –128°C, and can cope with wide temperature swings from day to night every sol. In
fact, the rover was designed to handle more extreme weather than it needs to, because the
landing site hadn’t been chosen when the rover design was finalized. Located close to the
equator and at low elevation, Gale’s weather is relatively benign. The REMS instrument
has measured overnight lows in the air just above the ground averaging around –75°C
(ranging from –85°C to –65°C), and daytime highs averaging around –10°C (ranging
4.4 Thermal Control 149
from –30°C to +5°C) (see section 8.4.3). Ground temperatures have been as warm as 15°C
and as cold as –100°C. 17
Different parts of the rover have different thermal requirements. The warm electronics
boxes inside the rover’s body and head keep their interiors warmer than –40°C and cooler
than 50°C, although their contents won’t fail as long as temperatures stay between –55°C
