InSight HP3 Mole

NASA/JPL-Caltech. Public domain (NASA / US government work).

Overview

The Heat Flow and Physical Properties Package on the InSight lander was to measure the heat flowing out of the Martian interior, which requires the product of a temperature gradient and a thermal conductivity, both measured below the depth reached by the annual surface temperature wave. Seasonal ground temperature at low latitude varies by about 20 K in its daily mean over the year, and the diurnal wave is larger still [5], so the measurement has to sit beneath both. That set the target depth at 3 to 5 m [1]. Rather than drill, HP3 used a self-hammering penetrator, the mole, which carried a string of temperature sensors on a trailing tether and thermal sensors in its own hull to measure conductivity as it descended.

The mole began hammering on sol 92, 1 March 2019, and stopped for the last time on sol 754, 9 January 2021, having reached about 40 cm, roughly one mole length, instead of the required 3 m [1]. The mechanism functioned as designed throughout; what failed was an assumption about the ground on which the mechanism depended.

Specifications

Parameter	Value
Length, diameter, mass	40 cm, 2.7 cm, 0.85 kg
Drive spring energy	0.7 J per stroke
Hammer mass	0.11 kg
Suppressor mass	0.46 kg
Hammer to suppressor mass ratio	1:4.2
Hammer to casing mass ratio	1:2.5
Forward strike force, healthy stroke	1180 to 1350 N
Stroke cycle	3.7 s
Design penetration depth	3 to 5 m

Values from [8].

Mission profile

Parameter	Value	Source
Host	InSight lander, launched 5 May 2018, landed 26 November 2018	[6]
Landing site	Elysium Planitia, about 4.5 N, 135.9 E
Entry, descent and landing	Unguided ballistic entry, 99 percent footprint 115 to 130 km along track by 25 to 28 km cross track	[6]
HP3 deployment on the surface	12 February 2019
First hammering	sol 92, 1 March 2019	[1]
Last hammering	sol 754, 9 January 2021
Depth reached	about 40 cm, roughly one mole length
Deploying arm	InSight robotic arm, 4 DOF, 1.8 m, refurbished from Mars Surveyor 2001	[7]
InSight mission end	15 December 2022

Mechanism

Inside the casing, a motor drives a cylindrical cam that compresses the drive spring [8]. Releasing the spring accelerates the hammer into an anvil at the tip, transferring momentum forward; the same release accelerates the suppressor, consisting of the motor, gearbox and driveshaft, backwards against a low-rate brake spring, which then returns it forward to deliver a second, smaller strike to the casing. The whole device is a mechanical diode: it converts symmetric internal impulses into preferentially forward motion.

Because it needs no reaction structure of its own, a mole is attractive for a small lander: it requires neither the mass of a drill rig nor a downforce path back to the spacecraft, and it dissipates little heat, which matters when the measurement being made is a thermal gradient [1]. The regolith it must penetrate has a thermal conductivity of 14 to 64 mW/m/K depending on layer [2], so parasitic heat from the penetrator would perturb the gradient it is there to measure.

The three-mass architecture, hammer, suppressor, and outer hull, was carried through coupled multi-body and soil simulation models used both to size the mechanism before flight and, after two fault incidents on ground units in 2015 and 2017, to diagnose what had gone wrong in the hardware from its behavior alone [8]. The same simulation lineage is why the design could state a specific recoil budget rather than an order-of-magnitude estimate.

The physics of the failure

A mechanical diode is not perfect. The suppressor mass moving backwards against the brake spring transfers a residual recoil force to the casing, and something outside the mole must resist it or the mole simply reverses out of its own hole. The design assumed that resistance would come from Coulomb friction between the soil and the cylindrical hull, integrated over the buried length [1]. That force is small: 5.4 N nominally on Mars, rising to 6.9 N in the unfavourable case where the mole strikes a hard surface that returns stroke energy elastically and fully compresses the brake spring.

Two conditions therefore have to hold. First, the soil must deform plastically under the forward stroke, which requires enough collapsible pore space around the tip for material to compact or flow into [1]; the InSight regolith has a bulk density near 1211 kg/m3 against a grain density near 3200, implying about 63 percent porosity, so pore space was not the limitation [2]. Second, the soil must close onto the hull behind the tip and grip it. Both fail in a cohesive material. Cohesion allows an open cavity to stand: the lateral earth pressure acting on the hull decreases as cohesion and internal friction angle increase. A soil strong enough to hold its own walls open therefore exerts almost no normal stress on the mole, and with no normal stress there is no friction, and with no friction there is nothing to react the recoil against. The mole hammers, moves forward on the strike, and comes back on the rebound.

The mole was designed for cohesionless soil with the rheology of quartz sand, which had been taken as the analog for Martian regolith [1]. Semi-empirical granular penetration models of the Bekker and Janosi-Hanamoto family, and the pile-driving formulations derived from them, take the normal stress the medium exerts on the penetrator as an input rather than predicting it [3], [4]. The InSight site instead has a cohesive duricrust of a few tens of centimeters beneath a thin unconsolidated layer, with a cohesion of 4 to 25 kPa inferred from the mole’s own penetration resistance and 5.8 kPa from slope stability of the pit walls, against 1 kPa or less for Martian sand [2]. When the support structure was lifted away on sol 227, the mole was found sitting in an open pit about 7 cm deep with steep, self-supporting walls, which is the direct visual confirmation that the soil was not in contact with the hull.

The mole reached 40 cm at all only because friction springs inside the tube of its support structure had been provided to react recoil during initial entry, before enough hull was buried for soil friction to take over [1]. Those springs did the job soil was supposed to do; when the mole left the support structure, the reaction force went with it.

Two further findings compounded the primary one. Penetration resistance was much higher than expected, so a more energetic hammer would have been warranted independently: 0.5 to 1.2 MPa in the duricrust and 5.3 MPa in a more resistant layer below about 30 cm [2]. And the support structure was too light to keep the mole vertical, so the mole tilted progressively, reaching 29 to 32 degrees from vertical by the end [1].

Recovery attempts

The Anomaly Response Team used the lander’s instrument deployment arm and its scoop to supply the missing reaction force externally, in four successive strategies over nearly two years [9].

Pinning pressed the edge of the scoop against the side of the mole hull to load it directly. Testing with the flight-spare arm in the JPL testbed established a maximum achievable preload of about 40 N [1]. Two pinning campaigns followed, from sol 291 and from sol 346, and both produced real downward motion, at rates up to about 0.3 mm per stroke. Both had to be abandoned for the same reason: keeping the scoop edge on the hull risked a sideswipe that would sever the delicate science tether, and each attempt to retreat to a safer geometry, pushing the scoop flat on the adjacent regolith rather than on the mole, removed the direct preload and with it the progress.

Every strategy was rehearsed first on a matched ground testbed, STL-3, filled with crushed garnet, before being commanded on Mars, with arm force telemetry from Mars sols compared directly against load-cell-calibrated testbed runs at the same poses [9]. That same push-force telemetry, from sol 240 and sol 250, gave an independent cohesion estimate of 3 to 14.5 kPa and a friction angle of 30 to 34 degrees by slope-stability analysis of the pit the arm was pushing against, consistent with the cohesion inferred from the mole’s own penetration resistance [9]. In the testbed, the arm’s own force limits, 80 N average and 40 to 80 N in the safe range near the mole, set what any strategy could apply in the first place; the flight arm’s measured scoop forces during the campaign, of order 55 to 77 N depending on extension, sat inside that envelope [10].

The back cap push placed the scoop directly over the mole’s aft end so that the preload acted along the penetration axis, replacing the 5.4 N of hull friction the soil failed to supply [1], [2], and the scoop physically blocked the rebound vector. It had been deferred because the arm’s positioning precision, the small irregular back cap and the tether all made it hazardous. Twelve hammering sessions over about eight months, totaling 1280 strokes, brought the back cap from 7 cm above the original surface to about 2 cm below it, at which point the scoop could go no deeper without widening the pit, for which resources did not exist [2]. During several of these sessions the mole made no downward progress and regolith grains sitting in the scoop were observed to begin jumping between successive images, which is direct evidence that the mole was bouncing against the scoop rather than advancing, and would have extracted itself had the scoop not been there.

Backfilling was the last strategy: scrapes on sols 673 and 700 and tamps on sols 686 and 734 pushed unconsolidated surface material into the pit and compacted it, with the explicit aim of putting soil back into contact with the hull so that friction, rather than the arm, could react the recoil [9]. Backfill material was the low-cohesion surface layer rather than the duricrust, whose 4 to 25 kPa cohesion is what allowed the pit to stand open in the first place [2]. A chop on sol 420 had earlier broken a piece of consolidated material into the pit, and a scrape on sol 598 nearly buried the mole.

The Free Mole Test on sol 754 applied maximum preload to the regolith above the mole and commanded 500 strokes, a deliberately large number so that the result would be unambiguous [9]. At a nominal 0.25 mm of progress per stroke in the qualification sands, 500 strokes corresponds to roughly 12 cm of expected penetration [2]. There was no downward motion, tilt wandered between 32 and 29.5 degrees, and grains on the scoop again moved erratically, indicating the mole was still rebounding. The campaign ended.

Power, thermal, and communications

The mole draws power from and returns data through the InSight lander bus; it has no independent power, radio, or computer. Its own sensors are what make it an instrument as well as a mechanism: resistance-foil temperature sensors in the hull for a conductivity measurement by transient heating, a tiltmeter for attitude, and temperature sensors along the trailing science tether for the gradient measurement [1], [2]. The tether is the system’s most fragile element and it constrained every recovery maneuver, because the scoop could not be permitted to load it in shear.

The hammer mechanism itself proved reliable. It executed about 12,000 strokes on Mars with no evidence of degradation, against a requirement of 20,000, and identical units exceeded 60,000 strokes in regolith simulant on Earth without measurable loss of hammer force [8].

Each hammering session, and every arm reposition around it, ran through collision checking that was new flight software for InSight’s arm, since no prior JPL lander arm had needed to plan contact-rich motion this close to a deployed instrument and its tether [11].

Modes of operation

Operation is a commanded hammering session of a specified stroke count or duration, followed by imaging and tilt readout to determine what happened, since the mole has no odometry. Depth was inferred from the length of science tether remaining above ground and from digital elevation models of the pit [1]. The first session on sol 92 was commanded for a 70 cm tip depth or four hours, whichever came first, and returned 3881 successful strokes without reaching depth; a second session of 4720 strokes followed. After the anomaly, sessions were short, tens to a few hundred strokes, each preceded by arm positioning and preload application and followed by reassessment.

Ground operations

HP3 was provided by DLR, with the penetrator developed with Astronika in Warsaw, and operated jointly with JPL, which owns the lander and its arm [1], [2]. The anomaly response ran from 2019 to January 2021 and its structure is the notable part: because no direct sensing of the mole’s state below ground existed, each cycle was image-driven, comparing tilt, visible tether length, and pit morphology between hammering sessions to infer what the subsurface was doing. Soil parameters were recovered from the interactions themselves. Scoop pushes into the surface and the chop that broke off a piece of duricrust yielded a cohesion estimate of 5.8 kPa, and applying cone penetration theory to the measured penetration resistance gave 4 to 25 kPa depending on the assumed internal friction angle [2]. Elastic moduli derived from seismic velocities, 4.32 MPa shear, 9.84 MPa bulk, and 11.30 MPa Young’s, were consistent with those cohesions through empirical correlations from terrestrial soil mechanics [2].

Late in the campaign the ground segment was also constrained by the lander itself: dust accumulation on the solar arrays and the approach of aphelion made power and thermal margin the limiting factor on how much hammering could be attempted at all, which is why the sol 754 test was designed to be decisive rather than incremental [1]. The arm itself kept working well outside its qualification envelope through this period, operating with joint motors unheated below -90 C against a -60 C qualification floor [10].

The hammering the mole did produce was also used for a purpose it was never designed for: each burst of strokes is a repeatable, known-location seismic source, and a pre-landing analysis had already worked out how to invert SEIS’s recording of it for near-surface P- and S-wave velocity and layer thickness, stacking many strokes and correcting for the mismatch between the hammer’s frequency content and SEIS’s sampling [12].

Results

The heat flow measurement was not made. What HP3 produced instead is a soil mechanics and thermophysical profile of the top half meter at the landing site, derived from a mechanism failing in a well-instrumented way [2]. The model is a 1 cm unconsolidated sand and dust layer, about 20 cm of duricrust, about 10 cm of unconsolidated sand, and below that a layer more resistant to penetration, possibly impact debris. Thermal conductivity rises from 14 mW/m/K in the surface sand and dust to 34 mW/m/K through the duricrust and the sand beneath it, then to 64 mW/m/K in the sand and gravel layer below [2].

One active-heating conductivity measurement was made at the shallow, stalled depth the mole did reach: a 2 W, 24-hour heating run at 0.37 m gave 0.039 +/- 0.002 W/m/K, implying a soil density of 1211 kg/m3 and 63 percent porosity, consistent independently with the bulk density backed out of the mole’s own penetration behavior [13]. The measurement also bounds grain-to-grain cementation: even 0.02 volume percent of cement as necks between grains would have doubled the conductivity, which was not observed, so any cementation at this site is a grain coating rather than a bond [13].

Technologies developed

The lessons the team drew are explicit and transferable [1]. A self-hammering penetrator is only mass-efficient if the ground supplies the recoil reaction; where it may not, the mass saved by omitting a reaction structure has to be spent somewhere else. Concretely: more system mass would have permitted a hammer mechanism with little or no residual recoil, a more energetic stroke to handle the observed penetration resistance, and a support structure heavy enough to keep the penetrator vertical and to resist being lifted by the rebound. And a mole intended for a site that may have duricrust needs a mechanism to support it to a depth of roughly two mole lengths, rather than one, before it is on its own.

The result generalizes to any reactionless or low-reaction surface mechanism. Its performance is a function of a soil property, here the normal stress the soil exerts on a buried cylinder, that cannot be measured from orbit and is not constrained by landing site selection: orbital thermal inertia at this site showed no duricrust signature at all [1]. Predictive models of wheel and penetrator interaction with granular media take that stress state as an input, and even the more accurate of them, resistive force theory and continuum plasticity, are validated against measured forces rather than against independently measured soil state [3]. Where such a mechanism is flown, either the uncertainty is closed by an in situ measurement before commitment, or the design has to work across the full range including the case where the soil grips nothing at all.

The recovery campaign itself only existed because the arm it depended on carried capability InSight had not planned to use: the scoop that ultimately pinned and pushed the mole was flight heritage from Mars Surveyor 2001 with no assigned role in the nominal HP3 timeline. A later survey of post-launch adaptation across eight planetary missions cites this as a case where carried-over hardware margin, not a contingency the mission had designed for, was what let ground teams respond to a failure mode nobody had modeled [14].