Curiosity

NASA/JPL-Caltech/MSSS. Public domain (NASA / US government work).

Overview

Curiosity is a six-wheeled nuclear-powered rover carrying an onboard sample-processing laboratory. The mission objective was to determine whether its landing site had ever offered conditions suitable for microbial life.

Specifications

Parameter	Value
Total mass	899.2 kg
Width / length	2.8 m / 3.0 m
Length with arm extended	4.7 m
Top deck height / total height	1.1 m / 2.2 m
Arm reach, body front to turret center	1.9 m

Values from [2].

The mission page gives the arm reach as about 2.2 m and the vehicle as 10 feet long, 9 feet wide and 7 feet tall [19], against the 1.9 m turret-center reach and the 3.0 by 2.8 by 2.2 m envelope in the flight system description [2]. The 2.2 m figure is consistent with the full extended arm length rather than with the turret center.

Mission profile

Parameter	Value	Source
Launch	26 November 2011	[19]
Landing	6 August 2012, Gale crater, 4.5965 S, 137.4019 E	[13]
Landing dispersion	2.385 km downrange of the aim point
Entry mass	3257 kg	[5]
Landed mass	850 kg
Instrument payload carried	75 kg	[2]
Aeroshell	4.5 m diameter, 70 degree sphere-cone
Samples analyzed through sol 2844	33 drilled rock and scooped soil samples	[4]
Stratigraphic section climbed through sol 2844	about 330 m
Drilled samples to date	42	[19]
Elevation gained on Mount Sharp	1 km, marked 26 August 2026

The mission page is ahead of the retrieved literature on cumulative totals: it gives 42 powderized rock samples taken with the arm drill and an elevation gain of 1 km up Mount Sharp reached on 26 August 2026 [19], against the 33 samples and roughly 330 m of section recorded through sol 2844 in the peer-reviewed mission summary [4].

Entry mass of 3257 kg against 836 kg for a Mars Exploration Rover put the vehicle outside the airbag mass range, and the landing system became a guided lifting entry at a hypersonic lift-to-drag ratio of 0.24 and a ballistic coefficient of about 140 kg/m2, followed by a 19.7 m Disk-Gap-Band parachute deployed at Mach 2.05, heatshield jettison near Mach 0.7, and powered descent on eight monopropellant Mars Lander Engines throttling over 400 to 3000 N [5]. At 17 m above ground level and 0.75 m/s the descent stage lowered the rover on three 7.5 m bridles [5] and held 0.75 m/s until bridle line force indicated touchdown. Lowering on bridles rather than landing the whole assembly keeps the descent engines roughly 7.5 m above the surface at touchdown and avoids plume-driven regolith erosion under the wheels.

The flown EDL matched the pre-flight Monte Carlo, which comprised 682 random dispersions across 4834 cases: every Timeline Engine event occurred within 6.9089 s of its predicted mean time, and reconstructed parachute deploy conditions were within 0.75 sigma in Mach number, 0.02 sigma in dynamic pressure and 0.14 sigma in altitude [13]. Entry interface was reached 3.5 km higher and 7.8 km further from the target than the expected mean, a 3.8 sigma excursion the entry guidance absorbed through three bank reversals at t = 612.875, 633.875 and 663.375 s.

Mobility

Parameter	Value	Source
Configuration	6-wheel drive, 4-wheel steer, rocker-bogie	[2]
Wheel diameter	0.5 m
Belly clearance on flat ground	0.66 m
Obstacle capability	approximately one wheel diameter
Tilt limit, structural	50 deg any direction without overturning	[3]
Tilt limit, fault protection	30 deg	[2]
Actuator reduction	1024:1 four-stage planetary	[1]
Actuator rating	10 A, 1000 Nm
Drive current software limit	5.25 A
Steer current software limit	4.5 A
Peak observed actuator current, first seven years	4.422 A
Design life requirement	20 km	[4]

Each wheel and steering actuator assembly contains a brushless DC motor, a brake and an incremental encoder [1]. The motor controller assembly carries eight driver boards and can energize eight of the rover’s thirty-eight motors at once, fewer than the ten wheel and steering assemblies, so mobility executes as steer-then-drive: the rover steers, sets the steering brakes, then drives, and encoders on the idle set are not monitored during the other phase.

Drives are composed from two primitives, a constant-curvature arc and a turn in place. Arcs are open-loop and terminate on wheel revolutions rather than on measured pose; 81.0 percent of the 22,312 arcs commanded in the first seven years were straight [1]. Turns in place close the loop on the IMU. Over the first seven years Curiosity drove 21,318.5 m, with individual sol drives from 2.6 cm to 142.5 m and a mean of 28.9 m [1]. Commanded motion split 72.7 percent forward, 18.4 percent backward and 8.9 percent turning in place.

Wheel damage was first confirmed from imaging on sols 488 to 490 [4]. Embedded rocks punctured the thin aluminum wheel skins earlier than predicted, because a rock fixed in bedrock does not yield and the full wheel load concentrates on it [7]. The specific mechanism is a suspension load path: five wheels build up load within the rocker-bogie that pushes against a sixth which has encountered a sharp obstacle. Backward driving was increased on sol 546 in response, then reduced again on sol 671 because it did not lower the damage rate and cost drive distance within the allotted time [1].

The durable fix was software. Terrain-adaptive wheel speed control uses measured attitude rates and rocker and bogie angles to estimate each wheel’s contact angle, then commands each wheel’s speed at 8 Hz so that wheels not currently climbing slow rather than pushing the climbing wheel into the rock [1], [10]. It was approved for nominal use on sol 1678; since then 99.48 percent of odometry has been driven with it enabled, at a cost of roughly 10 percent longer drives and about double the drive motor telemetry volume. It reduced mean and standard deviation of heading error on straight arcs by 41 percent, and reduced internal suspension loads as measured on the vehicle [4].

Damage is concentrated on the middle wheels and the left front wheel; the other three show little [4]. Two grousers had broken on the left middle wheel by sol 1641 and one on the right middle wheel by sol 2407. A JPL wheel and suspension test rig driven over analog Gale terrain established that a wheel with three broken grousers retains approximately 40 percent of its life, which put the flight wheels at sol 2844 at 16 km of remaining life each and at least 39 km in total, against the 20 km design requirement [4]. Rimmed wheel designs were subsequently evaluated on the Scarecrow mobility testbed [8], and terrain physical properties along the traverse were derived from combined orbital and surface data [9].

Power and energy

Parameter	Value	Source
Source	MMRTG	[2]
Electrical output at start of landed mission	approx 110 W
DOE best estimate, start of surface ops to end of mission	114 W to 108 W	[3]
Batteries	two lithium-ion, approx 42 A-h each	[2]
Battery discharge requirement	up to 555 Wh in one sol, 670 cycles from full charge	[3]
Available energy	approx 2500 Wh per sol

Output is thermal rather than photovoltaic, so generation is independent of season, dust opacity and time of day, which removes the dust-storm and winter-solstice power constraints that governed the Mars Exploration Rovers [3]. Peak rover loads exceed generator output, so the batteries buffer the difference and a deep discharge was not expected more than once per sol.

Two quantities decay together over the mission: MMRTG output per sol and battery capacity. Load energy has stayed roughly constant, so the battery is discharged to a lower state of charge each sol and less energy is shunted to the environment as excess [4]. The operational consequence is longer recharge intervals between drives rather than an outright loss of capability [1], moving toward reductions in energy use and additional time dedicated to charging.

The generator’s power prediction was checked against measurement three times before launch and once after landing, and the power agreed at every point while the thermal condition assumed for it did not. Post-fueling, flight unit F1 was predicted at 110.7 W at a 28 V bus with a fin root temperature of 132 C and measured 111.2 W at 31.4 V with the fin root at 90 C; at launch it measured 113.9 W at 32.9 V with the fin root at 96 C against 109.1 W predicted at 28 V and a fin root of 180 C [24]. About five hours after the heat rejection system vent on the surface, output was roughly 115 W with the rover bus at 31 to 32.7 V, against 106.3 W predicted for surface operations in spring at the median temperature case, 29 V and a fin root of 175 C. Reconciling three independent prediction engines, after the pre-fueling model was found to over-predict, left an uncertainty band of 6 percent at the start of the surface mission widening to 10 percent.

Thermal

The rover was designed to land anywhere between 45 N and 45 S, where surface temperatures range from about +40 C to -127 C, the CO2 frost point at Martian surface pressure, with diurnal swings up to 145 C [3].

Requirement	Value	Source
Avionics mounting plate and payload module held at or above	20 C for at least 6 h per sol	[3]
Plate minimum throughout the sol, worst case (winter at 45 S)	-40 C
Daily cycle limit on hardware	±30 C
Mobility actuator minimum before actuation	-55 C (wet lubricant)	[1]

Three mechanisms achieve this: internal dissipation, electrical heaters on specific components, and a heat rejection system built from two mechanically pumped fluid loops, the rover loop and the cruise loop, thermally coupled to each other during cruise [3], [14]. The working fluid in both is Freon, CFC-11. The rover loop moves heat from the generator to the electronics when it is cold and from the electronics straight to the environment when it is warm; the generator produces about 110 W of electrical power and roughly 2000 W of waste heat [12]. MMRTG waste heat is harvested through a pair of heat exchangers that surround the generator at the aft end of the rover: honeycomb-core sandwich panels with hand-bent aluminum HRS tubing bonded to both faces, built with aluminum facesheets and aerogel inside a composite honeycomb core so that in-plane conductivity is high and through-thickness conductivity very low. The MMRTG-facing surface acquires heat and the outward surface rejects it, and the two surfaces must sit at very different temperatures for the loops to work, which is what the aerogel core buys.

Mobility actuators are a separate thermal case because their wet lubricants should be above -55 C before actuation [1]. Platinum resistance thermometers on each actuator feed closed-loop heating, controlled for all drive actuators from a single drive thermometer and all steer actuators from a single steer thermometer. There are two mobility heater circuits; using the backup requires swapping from the prime to the backup power and analog module. Preheat duration is predicted from thermal models when a drive is scheduled, because preheating consumes both energy and clock time.

Compute and avionics

Parameter	Value	Source
Processor	BAE RAD750, PowerPC 750 architecture, radiation hardened	[1]
Clock	133 MHz
RAM	512 MB
Operating system	VxWorks
Non-volatile storage	32 Gbit on the NVMCAM card	[3]
Backplane	CompactPCI
Command and data bus	MIL-STD-1553
Redundancy	two rover compute elements, one active

The two rover compute elements are operated one at a time with the spare in cold backup, except during entry, descent and landing when the second acts as a hot backup [3]. Power switching and analog input and output are handled by redundant rover power and analog modules connected to the RCEs over MIL-STD-1553.

Cross-strapping is partial. Each engineering camera pair is wired to one computer: RCE-A carries one set of hazard cameras and RCE-B the other, so switching to the backup cameras requires switching computers [1].

RCE-A was prime at landing. A failing region of RCE-A NAND flash on sol 200 removed half of that side’s flash from use and forced a swap to RCE-B on sol 201 [1], [4]. RCE-B ran the mission until sol 2173, when its data-product partition failed to mount; the team switched back to RCE-A on sol 2188 and stayed there until the RCE-B partition had been reformatted on sol 2342. Cumulative driving splits 1158.793 m (5.63 percent) on RCE-A, over sols 15 to 166 and 2250 to 2338, against 20,159.565 m (94.37 percent) on RCE-B [1]. Unexpected flight software resets on sols 2320 and 2339 led the project to declare the remaining A-side flash unreliable and to withdraw the A side from nominal science operations; a build was developed to give the A side cross-string diagnostics and the ability to keep the rover safe indefinitely while the B side is recovered, installed on sol 2963. Loss of rover flash memory remains one of the mission’s four top unrealized internal risks.

The 133 MHz processor bounds visual navigation throughput [1]. Acquiring, processing and writing the data products for one visual odometry stereo pair takes 47 s on average, a figure set jointly by the processor, the operating system, the camera and camera interface design, and flash write time [1]. The verification campaign for running visual odometry concurrently with driving, rather than stopping to compute, is documented separately [12].

Autonomy

Light time and relay latency preclude real-time intervention during a drive, so the rover carries three onboard layers: visual odometry, hazard detection and avoidance, and visual target tracking [1]. Fault protection trip thresholds are parameters set per drive by human rover planners.

Visual odometry tracks features between stereo pairs to measure actual against commanded motion, which is what makes slip observable [2]. Three modes are available: slip check, which takes a stereo pair every 20 m to bound accumulated error with no imagery in between; full mode, imaging throughout; and VO auto, in which the rover switches between the two according to local terrain, motor current, angular rate during turns in place, and measured slip [1].

Path selection is commandable separately from odometry mode.

Mode	Behavior	Source
Directed	follows the commanded path	[1]
Guarded	heads for the goal, consults the onboard world map, stops on keep-out zone or geometric hazard
AvoidKOZ	routes around manually specified keep-out zones only
AutoNav	routes around both geometric hazards and keep-out zones, building the world map as it goes	[1][2]

Modes mix within a sol: a drive commonly runs directed to a first waypoint, then switches to VO auto plus AutoNav to extend the traverse into terrain the planners could not assess [1]. With global path planning enabled, AvoidKOZ and AutoNav plan in a 2.5-dimensional world model without predicting suspension configuration. On sol 385 Curiosity drove 141.5 m, 5 m further than predicted, because AutoNav routed around hazardous terrain near the end of the drive [1]. Onboard image-based path tracking is also used to reduce positional uncertainty and so support the route-level avoidance of wheel-damaging terrain [4].

Communications

Link	Parameter	Value
X-band DTE/DFE	Amplifier	15 W SSPA through gimballed HGA or rover LGA [3]
X-band downlink	Coding	turbo, rates 1/2, 1/3, 1/6 [3]
X-band downlink	Information rates	10 bps to 62,500 bps [3]
X-band downlink	Symbol rate cap	300,000 sps [3]
X-band downlink	Frame	1784 bits, interleave depth 1, code efficiency 0.86 [3]
X-band downlink	Rate at maximum Earth range, 34 m station	approx 160 bps [3]
X-band uplink	Emergency rate through rover LGA, 70 m station	7.8125 bps [3]
UHF relay	Transponders	two Electra-Lite, more than 8.5 W out of the diplexer [3]
UHF return	Rates	2 kbps to 2048 kbps, effective throughput capped near 1.35 Mbps [3]
UHF forward	Rates	2 to 256 kbps; 32 kbps baselined for MRO [3]
UHF channels	Return / forward channel 0	401.585625 MHz / 437.1 MHz [3]

The 300,000 sps symbol rate cap excludes the combination of 62,500 bps with rate 1/6 [3]. The 0.86 code efficiency against 0.58 on MER is worth 1.7 dB, which mainly benefits the lowest rates.

Orbiter capability differs by radio. With MRO the return link uses suppressed carrier and adaptive data rate, in which the Proximity-1 protocol renegotiates rate during the pass. Odyssey, whose CE505 radio supports only 8, 32, 128 and 256 kbps, uses residual carrier at a fixed rate per contact, and only 8 and 32 kbps are available on its forward link [3]. Two alternate channels each are held in reserve against electromagnetic interference on MRO. Proximity-1 sequence-controlled transfer is nominal; unacknowledged bit-stream mode was used for entry, descent and landing, where MSL broadcast at 8 kbps [3].

MRO flies a Sun-synchronous orbit crossing at 15:00 local mean solar time, with a pass pattern repeating every 17 sols, delivering 30 to 600 Mbit per pass and 100 to 1150 Mbit per sol, against a requirement of 250 Mbit per sol over two passes [3]. Loss of a relay orbiter, MRO or Odyssey in particular, is the mission’s principal external risk, because the pace of operations depends on their consistent afternoon overflights [4].

Maximum MRO pass elevation angle against sol for a rover at the equator, 10 degree elevation mask [3]. The beat between the 17-sol MRO ground track repeat and the sol sets the day-to-day variation in achievable relay volume that the tactical cycle has to budget against. Source: [3]. Public domain (NASA).

Surface operations use X-band for uplink and UHF for downlink, with relay uplink available [3]. The generalized telecom predictor is run daily as part of the tactical process, because relay volume prediction gates what can be planned.

Communication behavior is table-driven: a primary table of up to 256 communication windows for standard operations and a separate high-priority table for anomalies [3]. Flight software blocks activities that would generate radio frequency interference during a window. The remote engineering unit in the power and analog module stays powered whenever the rover sleeps and is redundantly connected to both Electra-Lite radios, so an orbiter hail can wake the rover.

Payload and instruments

The arm is a 5 degree-of-freedom manipulator of 70 kg mass, reaching 1.9 m from the front of the rover body to the turret center when fully extended [2]. The turret is 0.6 m in diameter and 30 kg, carrying five devices: the APXS and MAHLI contact instruments, the Powder Acquisition Drill System, the Dust Removal Tool, and CHIMRA.

Instrument	Key parameters	Source
ChemCam	1067 nm laser, 350 to 550 um spot at up to 7 m standoff, 10 Hz; 242 to 800 nm spectrometers at 0.2 nm FWHM below 500 nm and 0.65 nm above; mast unit 5778 g, body unit 4789 g with TEC	[15]
MAHLI	1600 x 1200 pixels at 7.4 um, 18.4 mm focal length, working distance 2.1 cm to infinity, approx 14 um/pixel at closest focus, white and 365 nm UV LEDs, 8 GB non-volatile memory, 0.578 kg camera head	[16]
CheMin	cobalt X-ray tube at 28 keV and 100 uA, approx 70 um collimated beam, 5 to 50 deg 2-theta at better than 0.35 deg, CCD 600 x 582 at 40 um and 1 to 15 keV, 27 reusable Mylar or Kapton windowed cells	[17]
SAM	40 kg suite; 74 sample cups of which 59 quartz for evolved gas analysis and 9 foil-topped for wet chemistry; pyrolysis to 900 C nominal and 1100 C with the auxiliary heater; QMS 2 to 535 Da; six GC columns; helium carrier at 0.03 atm-cc/s	[18]

ChemCam thermal design is set by the fiber optic run from mast to body: the fiber survives -130 to +110 C but operates only over -90 to +50 C, and the body unit spectrometer CCDs are held by 3 W thermo-electric coolers within a -40 to +50 C envelope [15]. CheMin’s CCD is operated at -60 C by design and ran between -48 C and -22 C on Mars [17]. Cell window material is a deliberate split: Mylar gives a flat diffraction background across the full 2-theta range but is less durable than Kapton under vibration, so both types are carried on the sample wheel.

Mast-mounted instruments are the Mast Camera pair and ChemCam. Environmental and radiation monitoring is by REMS, RAD and the DAN neutron spectrometer. REMS wind sensors on boom 1 were inoperable on landing and boom 2 sensors were only partially operational until about sol 1500; the suspected cause, landing debris or blowing sand, could not be confirmed at the available imaging resolution [4]. The DAN active neutron generator operates past its expected life at reduced output.

Sample acquisition

Parameter	Value	Source
Drill bit	5/8 in (approx 1.6 cm) commercial hammer drill bit in a thick-walled tube	[6]
Hole geometry	1.6 cm diameter, up to 5 cm deep	[2]
Percussion rate	1800 blows per minute	[6]
Percussion impact energy, variable	0.05 to 0.8 J
Weight on bit during acquisition	120 N
Spare bits	two, in bit boxes on the rover front panel	[2]
Scoop depth / volume	up to 3.5 cm / 1 to 30 cm3
CHIMRA sieve meshes	less than 150 um, and less than 1 mm
Portion volume to SAM via the 1 mm path	45 to 130 mm3
Sample drop-off air gap into the instrument funnel	2 to 5 cm

Powder travels up an auger in the drill into a chamber connected by transfer tube to CHIMRA, and through CHIMRA by gravity, changing the arm position and orientation, plus vibration [2]. The percussion mechanism supplies both the impact that breaks the rock and the vibration that moves powder through the bit assembly [6]. The drill chuck mechanism releases worn bits and takes fresh ones from the bit boxes, and was required to release a bit while loaded by the worst case of complete rover slip on a Martian slope. The 2 to 5 cm vertical air gap the portion crosses on its way into the instrument funnel is exposed to wind, so a wind guard was added [6]. Five Organic Check Material canisters are mounted on the rover front for contamination control.

Cross section of the drill bit assembly. Rotation and percussion are transmitted down the bit through a dirt-tolerant torque coupling that accommodates axial, radial and angular motion between spindle and bit; powder travels up the flutes into the chamber above. Diaphragms radially constrain the rotating bit and form the dust seal. Source: [6]. Public domain (NASA).

Three mechanism failures have reshaped sampling. The percussion mechanism carried a known pre-launch flaw that could produce electrical shorts; the first occurred on sol 911 during sample transfer from drill to CHIMRA, and the response was to raise onboard fault thresholds to tolerate low-current shorts and patch the motor controller software to protect sensitive electronics and monitor currents during percussion [4]. The CHIMRA tunnel motor, used to inspect and clean the 150 um sieve, stalled on sol 1231; the stall has not repeated and use limits were imposed. The drill feed motor stalled on sol 1536 at Precipice and was declared unreliable. Feed retraction is required to move collected material into CHIMRA, and a permanent failure in the retracted state would have left the drill unable to extend past its stabilizer posts to reach the surface at all. The project therefore developed Feed-Extended Drilling and Feed-Extended Sample Transfer, which keep the feed fully extended and portion sample with small pulses of rotation and percussion, delivering material directly from the drill and bypassing CHIMRA, so FEST portions are unsieved. Twelve of the 33 samples analyzed through sol 2844 were acquired after the anomaly [4]. Rotary-only drilling, developed as a hedge against losing percussion altogether, makes steady progress for 10 to 30 mm in analog mudstones and sandstones and then becomes extremely slow [4].

Modes of operation

Surface activity is organized by sol, the Martian day of 24 h 39 min 35 s [3]. Within a sol the rover executes an uplinked sequence covering imaging, arm work, instrument operation, driving and communication windows, generating continuous engineering housekeeping telemetry and episodic event records buffered for the next pass.

Safe mode is entered when flight software detects an anomaly: the rover abandons the current plan and the prime RCE reboots into a minimal configuration [1]. Three planned drives were lost this way in the first seven years, on sols 697, 1391 and 2340; the sol 1391 case followed a flight software consistency check failing on sol 1389.

Below safe mode is a graded set of mobility fault responses.

Drive outcome statistic, first seven years	Value
Attempted drives	738
Ran to completion	622
Stopped early or never started	116
Predicted cumulative odometry still achieved	91.7 percent
Distinct fault categories that have stopped a drive	24 (16 mobility, 8 general fault protection)
Faults that were expected rather than anomalous	29
Of those, the time-of-day limit	26

Counts from [1].

The time-of-day limit is a deliberate cutoff so that post-drive imaging and the relay pass still fit in the plan, and autonomous drives are routinely commanded to run until it so that they cover as much ground as the allocation permits [1]. Relay volume prediction feeds that allocation directly [3]. The remaining expected faults were single occurrences of exceeding the slip limit (sol 983), the tilt limit (sol 151) and entering a keep-out zone (sol 163).

The rover maintains four mobility error states: mobility goal error, mobility motion error, mobility precluded, and DO MOBILITY false [1]. A time-of-day fault clears its own error state so that the scripted post-drive turn to a communications-favorable heading still runs; most other faults require ground intervention to clear, and 81.0 percent are cleared within a sol or two. DO MOBILITY is set false by an unstowed arm, an open MAHLI lens cover, an unstowed Mast Camera focus mechanism, CheMin or SAM in use, or ChemCam outside its Sun-tolerant focus range, which is how instrument state interlocks against driving [15]. Fault responses are themselves parameters: after five occurrences of a detected MMRTG short blocking a drive, the team set the short response parameter to ignore for all steer and drive actuators on sol 1309.

Ground operations

Curiosity is operated from JPL on a two-tier cycle. A strategic team works weeks to months ahead, using HiRISE imagery from MRO, which orbits between 255 and 320 km and resolves about 0.3 m per pixel at 300 km, to recommend routes that balance science targets against terrain risk [1]. Strategic route planning is also the primary control on wheel damage rate, avoiding terrain assessed as risky at the route level rather than only at the drive level [4]. Tactical rover planners build each sol’s drive from a high-resolution terrain mesh generated from NavCam stereo acquired at the end of the previous drive, and may depart from the strategic route where the closer imagery reveals a hazard.

The tactical product is a command sequence, simulated before uplink in the Rover Sequencing and Visualization Program, which also produces the predicted odometry against which the executed drive is later compared [1]. Because the sol is 39 minutes longer than an Earth day, a planning cycle locked to the rover’s local time walks through the terrestrial clock; the team worked that shifting schedule during early surface operations before moving to an Earth-aligned cycle.

Drilling has its own approval gate. Before each attempt the team assesses rover stability against drilling forces and dynamics, the safety of the drill against the target, the risk that drilling displaces or fractures the rock and so removes the pressure needed to force cuttings into the drill stem, and the possibility that the powder will clog or stick to hardware given its composition; approval comes from a group of engineers, scientists and project management [4]. Given the prevalence of small blocks and highly fractured outcrops, the team has on several occasions accepted that acquisition may not complete, provided risk to hardware is ruled out.

Ground segment failures propagate directly into lost science. Seven planned drives were never attempted because the plan did not reach the rover, including sols 1068 to 1070, lost to a complex-wide power outage at the Madrid Deep Space Network site [1]. A further six were withdrawn before uplink, typically after downlink revealed that a prior sol’s activity had failed. Hardware is inspected on a schedule as well as on event: the center differential pivot close-out plate is imaged annually and its sixteen fasteners checked for movement, after loosening was found on the Scarecrow test rover.

Technologies developed

Sky crane landing, radioisotope surface power with a pumped-loop thermal system, and onboard sample analysis were all first flown here, and Perseverance inherited the chassis, mobility system and landing architecture [5].

Terrain-adaptive wheel speed control established that wheel damage from embedded rocks is controllable in software on an already-built vehicle, by modulating per-wheel speed from suspension kinematics [1], [10]. The wheel life model derived from the JPL suspension test rig, which relates broken grouser count to remaining wheel life, gives a quantitative basis for route selection rather than a qualitative one [4]. Feed-Extended Drilling and Feed-Extended Sample Transfer demonstrated that a rotary-percussive sampling chain can be reconfigured in flight to operate with a failed feed actuator and without its sieving and portioning stage. Visual odometry work led to running visual odometry concurrently with driving rather than stopping to compute, removing the stop-and-think duty cycle that had limited MER and MSL drive rates [12]. The operational pattern is now standard for Mars surface robotics: strategic route planned from orbital imagery, tactical sequences built and simulated daily from the rover’s own stereo imagery, and layered onboard fault protection parameterized per drive [3].