Mars Polar Lander fault identification using model-based testing

This paper describes the application of the Test Automation Framework (TAF) on the Mars Polar Lander (MPL) software. The premature shutdown of the descent engine on the MPL spacecraft is believed to be the most likely cause for the mission failure. It is believed that the engine shutdown occurred when the three landing legs were extended into their deployed position. This event created an unanticipated transient touchdown indication from the legs, causing the software to inadvertently shutdown the descent engines prior to reaching the surface of Mars. This spurious indication should have been ignored by the touchdown monitor (TDM) software, but due to a design flaw, was actually "latched," thus causing the premature engine shutdown. The TAF approach was used to model the TDM software requirements. The associated TAF tools generated tests that identified a potential TDM fault