P2K: Where did the idea of using airbags on Mars Pathfinder come from?

Tom Rivellini: Originally the Mars Pathfinder mission started off as the MESUR (Mars Environmental Survey) network mission, and that was a proposal that came from NASA Ames, and they had proposed sending down a series of small spacecraft, small landers, to the surface of Mars using airbags to do a low-cost network type mission. And that's where the original notion of doing this network-style spacecraft with airbags came to JPL. We were given carte blanche to take a look at the proposal and come up with something on our own, or come up with something different if need be. And, you know, as it turns out, to do a low-cost spacecraft, a low-cost lander with high reliability and be able to land in interesting, exciting spots, airbags were the right answer. And so we thought that we had a big uphill battle in terms of finding research on it, nobody had ever done it.

And then all of a sudden, one morning, I walked into my office and somebody had left a journal article by a guy at JPL, written 1966, about how to use airbags to land on other planets. And so I looked at the name, and I'm like "Bill Layman... hey, wait a minute, that's the guy who works down the hall." So, it was kinda funny, but these guys had already been looking at the stuff 20 years ago. So, that actually gave us quite a boost in terms of theoretical places to start. But we basically found out that we could get some good ideas from it, but it was just a vast unexplored territory of research for us.

P2K: So how did you start going about solving this problem, "idea's good", but what do you do next?

Tom Rivellini: We started reading more and more papers, doing as much research as we could to try to figure out who had done anything even remotely similar. We went and talked to the military, went and talked to the Air Force, went and talked to the government labs, Sandia Labs, and all these places. And as it turned out nobody really had anything to offer of real, valuable importance. It was just... no-one had ever done anything like this before. Anything even close enough that we could extrapolate from. So, we just sat down and sharpened our pencil and started from point one.

And we teamed up with Sandia National Labs, because they had a parachute lab there and people had been used to working, you know, building fabric structures, and they were government labs so we could team with them easily, and we started building sub-scale airbags. And we started, you know, hitting them, we started dropping them in vacuum chambers, and out in the field between mountain tops, and just playing around with these things to try to understand how airbags work and you know what things we need to watch out for. As we call... we spent time uncovering the "unknown unknowns."

And pretty quickly we realized that there was a heck of a lot more that we did not know about airbags than we did. And at that point it was just a matter of "test, test, test." And then when you thought you'd tested enough, just keep testing some more, because with airbags, turns out that's really the only way to get smart.

P2K: Did you find it hard to get American spacecraft engineers, hardware guys, to take "soft goods" seriously?

Tom Rivellini: (laughs) Getting the JPL hardware engineers to respect and to understand the vagaries, to understand the vagaries of soft goods engineering, was probably the hardest part of my job. I spent a lot of time trying to tell people, you know, keep all the corners of your hardware nice and round. And they would be like, "Well, what do you mean by round?" And I'm, like, "I don't know... Would you feel comfortable about rubbing your shirt up against it without tearing it open?" And I spent a lot of time just trying to do these very qualitative discussions with hardware engineers, because it's just too difficult to get this kind of qualitative stuff into drawings.

P2K: The way Brian Muirhead tells it, this was your first real job with flight hardware: this was a pretty hard way to start!

You know, I was, what?, 24 when I first came to JPL and I designed a little bracket that was about that big, (gestures to indicate a pretty small item), that went up on an Air Force satellite, and I thought that was pretty neat. But then Pathfinder came along and, you know, basically I was too ignorant to know that I was getting in way over my head (laughs), and I actually think most people were too ignorant just in terms of what the Pathfinder spacecraft development was going to turn into to know that they should never have given me this job. But, nonetheless, I got the job, and I just, you know, I woke every morning and was just totally enthusiastic about it, and just totally loved it. And so it was easy to put in many hours, and weekends and everything that it took to make it happen.

P2K: How did the first set of airbag tests that you did with the Pathfinder system go?

Tom Rivellini: The first set of bags that we dropped we called "Prototype 1." And that was a real eye-opener. For starters, we broke the bag just doing "proof test" inflation: we burst them open in an area we never thought would happen. So we had to take the bags back to ILC Dover and repair all of them. And then we brought them back.

And we were just doing these really simple drops on a flat platform, no rocks, no nothing, and by sheer coincidence, before we did the tests in the chamber, one of the light bulbs had broken and had thrown broken glass shards onto the platform, little pieces of glass that big (gestures, once again to show they are very small), and we didn't even know it had happened. But when we were inspecting the bags afterwards we saw these little cuts and nicks in the airbag, and pieces of glass on the inside, and it sorta dawned on us that if a little piece of glass, that big, is breaking through the airbag and going inside, (chuckles) what are these big rocks going to do to us?

So when we finished those three drops on the flat platform, we made a wise decision to bring the bags back and retrofit them, and put extra layers of what we now call "abrasion" material on the outside. We started off with a bladder layer and one abrasion layer. And so we thought we'd get really strong, and really beef these bags up, and we put another abrasion layer on the outside. And we came back, and we tested them, and I think that it was the very first test that we did on the sloped platform with the rocks, and we got these huge gouges in the airbags, and we were just not happy. So we thought, well let's try it again. We'll bump up the velocity. We were only at half the expected velocity. So we bumped it up a little bit more. And that was drop test #5... and that was particularly bad. (Emphasis.) We just ripped the bag open from seam to seam, it was just an awful thing. And that's what really let us know that we had a long way's to go here. We were just getting started.

P2K: How confident were you by end of process, as Pathfinder was rocketing to Mars, were you sure everything was going to work right with your bit of the process?

Tom Rivellini: By the time launch came, we were extremely confident. I mean, I remember Tony Spear coming to me and saying "Rivellini, if I give you all the money, and all the time that you wanted, what would you do different." And I really scratched my head and said, "Tony, keep the money, we would not do anything different. We have tested them as much as we need to test them. We have very high confidence. We have done all the retraction testing, the inflation testing... We've done everything that we think we need to." And for the drop conditions, the landing conditions that we were being told to expect, I think we're there. So, you know, during cruise and everything, I think everybody's all worried about the airbags, because nobody knew the airbags, and I was sitting pretty comfortable. I was actually worried about the electronics and the navigation, all the things that I had no control over. So...

P2K: So with the success of Pathfinder, the Mars Exploration Rovers mission is a piece of cake, right... no problem... everything's just the same, and the airbags are just the same... and everything... is tickety boo...

Tom Rivellini: Yeah... (as in Yeah, right - with sarcasm.) No... NASA's Mars Exploration Rovers project has "evolved." You know, originally it was supposed to be a... almost "build to print" of the EDL system. But as things always go, minor changes in one area propagate and turn into major changes in a design. And, you know, it was inevitable. I mean, I think we all knew, from the beginning, that that was going to happen. With respect to the airbags, due to the vagaries, and the uncertainties of airbag design, and just the difficulty in doing any kind of analysis, and the fact that you gotta test to make any kind of change, I think there was a healthy respect for trying to keep the airbags as intact, from a design standpoint, as possible. But even there, there are changes being made.

I mean, in Pathfinder we learned that multiple layers of a thin fabric perform a heck of lot better than a few layers of a heavy fabric in protecting the airbag bladder. So we learned that on Pathfinder, and come the Mars Exploration Roverss we had more types of fabric thicknesses available to us, in the Vectran fabric that we use. And so we said, "Hey, we got some thinner stuff, let's try this, it might work even better. We might save some mass." So we've been trying that, and most likely we're actually going to incorporate the thinner abrasion layer materials, and more layers of it even still.

But... you know, even then, the drop conditions are changing, which are the landing conditions, and slight changes in the landing conditions, you know they propagate into the airbag design. So you have to start testing again, and you have to see if the airbags that worked for... Pathfinder may or may not work for the Mars Exploration Roverss. And so that's what we're doing, is trying to find the performance envelope of the airbags giving you the Mars Exploration Rovers mission conditions and it will result in changes.

P2K: EDL Chief Engineer, Wayne Lee, had said to come (to NASA Plum Brook in October 2001) for the first set of tests... and afterwards, there were some pretty long faces. What had happened?

Tom Rivellini: The October tests... Yeah. Well, the October tests were the first drop tests done on a Mars Exploration Rovers bag, fresh Mars Exploration Rovers bag, just fabricated, with all of its associated changes, with a Mars Exploration Rovers lander which is considerably different from the Mars Pathfinder lander - it's physically larger, it's physically a lot heavier, it has different interfaces. And the drop conditions were different. The velocity was slightly lower but the lander mass was a lot heavier, so they made up for each other. And the rock field was different. We tried a different rock field than we did on Pathfinder. We thought we would get a little bit smarter. And a little bit more conservative. So we made the rock field a little bit more aggressive. And you know we got some failures we just did not expect. We blew out some end caps. We got some tears in some areas between the tendons, and you know we were really scratching our head trying to figure out what happened, and, truth of the matter, we don't really know. Our best conjecture is that we just hit areas that were not exercised during Pathfinder. We did not hit those areas when we were doing our drop tests. So that implies that we either got lucky on Mars, we got lucky in our drop tests, or we just did not look at our books well enough, and we did in fact hit those areas during Pathfinder and something else is going on. And then the end caps, you know, we're getting some rock strikes in some areas that, you know, on Pathfinder were working fine. Again, we don't really know what's going on. It could be just the subtle changes in increasing the numbers of layers of fabric, like I mentioned before... It's just a very difficult design space to work, because you make one little change over here, and it has effects that you would never imagine.

Airbag design is not at all like orbit design. You can't just take Newton's Laws and apply them directly, although they are perfectly in action in terms of what causes airbags to work or not. It's just... we don't know to apply them. So what winds up is we just test 'em. We just drop test them, and we see how they fail. And a lot of it is "forensic engineering." We sit there and you look, at what tore. You look at how it tore. You watch the videotapes. You press rewind a gazillion times just to see how it happened, how it failed, where it failed. We put chalk dust on all the rocks so we can correlate exactly, "OK, this rock caused this failure, this rock caused this failure..." and we just sit there and inspect every single seam of the bag, after every drop. And we use our best judgment.

And we have sort of built up this database in our heads and on paper of what different tears look like. We have different classifications of tears. There's the "classical abrasion tear." There's the "bladder tear." There's the "pull-out tear." And there's all these different types of tear and failure modes that we've got catalogued. And whenever we see something that is beyond what we expect, then we sit down and figure out, "Well, why do we think this happened, and what do we think we can try to fix it?" And since we never really knowm we usually have to try 2 or 3 different things and see which one works better and start going that way. And then try 2 more, 2 or 3 more different things, and keep trying.

P2K: We were pretty astonished to see the room full of ILC folks, you, John Carson, Adam, Wayne, with that whiteboard used for math, logic, physics, management theory: what was going on there?

Tom Rivellini: What you saw there was real-time forensic engineering. We were trying to reconstruct what happened. We were trying to reconstruct the failures that we saw. You don't know for sure exactly what happened and how things happened. So it's all just a bunch of theories. And we're all busy trying to get our theories down on a whiteboard so we can, you know, communicate them to each other. And so somebody says that, "Part of that I believe, but the other part I don't believe. And what about this..." And we sort of build on each other's theories of what happened. And you know time is of the essence because you've got a crew of 20 people getting ready for the next drop. Trying to figure out shall we repeat the same drop and try to reconstruct the failure, or do we move on to something else and try to find different failures. Or try to find different tear modes, or whatever.

P2K: It was very interesting to see how many people get involved... and it was interesting how folks back at JPL began intervening... and telling the JPL folks on location, and the people from ILC, well, we're not going do it that way...

Tom Rivellini: You know I've sat in on a lot of sub-system areas and for some reason the airbag area always seems to be the one that gets a lot of attention, for better or for worse. There's a lot of "help" that people want to provide there. And, on the one hand, management is very concerned about the progress of the airbags, because it's one of the areas which is very visible and has very serious consequences whether it works or whether it doesn't, and how close to that boundary you are. And then within the sub-system there are just a lot of people partaking in the development of it. John Carson who's the airbag "coggy" (Cog-E, or cognizant engineer) on NASA's Mars Exploration Rovers project, he's responsible for making the airbags work, and delivering a product to the spacecraft. There's the ILC Dover folks who are actually responsible for fabricating the airbag. There are people like myself and Adam and Dara, who are responsible for making sure that the airbag works as a system along with the RAD system, along with the parachute, so that the end conditions of the parachute, and the RAD rockets and the TIRs that puts the airbags right in the sweet spot that they want to work in. So there are just a lot of different facets to the problem of an airbag and a drop test. And everybody wants to be involved because everybody's got a stake in it.

P2K: When we met you at Plum Brook, you were a consultant, but now you're back on NASA's Mars Exploration Rovers project full-time?

Tom Rivellini: Yeah, back in October I was still working on what was at that point called the "07 Mars Smart Lander" mission, and that was great. We were developing the next generation landing system, for a large scale rover, something the size of a Volkswagen bus. But, that mission got pushed out into '09, and the work force that was working on that pretty quickly got absorbed into the Mars Exploration Rovers workforce. And, you know, I was unemployed, so to speak, for about half an hour (chuckles), and I was already on the Mars Exploration Rovers team. So it's just been great. It's sort of like going from being a reservist in the military to being thrown into the frontlines, and having to start fighting right away. And, you know, it's fun, that's what we're here to do.

Working on a flight project, especially one like NASA's Mars Exploration Rovers project, or Pathfinder, is, I mean for me, the closest analogy is working, being a soldier on the frontlines. You are there, you are the frontline, you are where the action is happening. If you drop the ball, there are serious (consequences), not tomorrow, not the next day, but now, right away. And there are a lot of people counting on you not to drop the ball. And there's a lot of pressure. But it's exciting because you know what the end product is. You know when you win that battle the reward is historic. The reward is incredibly rewarding from a personal standpoint. And it's just one of those accomplishments that when you put that framed picture of Mars on your mantle and you can point to it and say "I did that", there are few things in life that actually come close to just the personal reward that you get from that.

P2K: What has changed in the design of the airbags from October 2001 to now (December 2001)? How novel are the changes from Pathfinder to the Mars Exploration Roverss?

Tom Rivellini: The changes that we are looking into for the Mars Exploration Rovers bags, based on what we found out during the October drops, you can sort of look at it in two ways. We are actually building two bags for the next test series.

One bag, which we are calling our "baseline bag" basically has direct fixes for the specific problem areas that we found. We found that we were having some problems with the airbags, so we made some significant design changes locally to the end cap areas. We also found out that we were tearing pretty consistently in what we call the "helical gores", the area right close to where the tendons come in. And we were always getting tears there, so we reinforced that area. So you sorta think of it as fixing specific problems, almost like adding Bandaids, if you will.

Then we said, well if we still get problems with all those Bandaids, we need to have a backup plan. So we came up with a second bag which has 3 completely different approaches, to the same airbag design. Two of them have double bladders, sort of like an inner tube, very different than the way the Pathfinder bags worked. One of them we did with a heavy double bladder, and the other we did with a really, really lightweight parachute cloth double-bladder. The idea is that if you tear through the main bladder, the main stress bladder, that this inner one is still loose and is not under tension and it should move instead of tear. That's the theory, we'll see if it works.

And then we've got another bag that we call "The Wig." Where we took the whole abrasion layer, and instead of integrating it directly to the airbag into all the seams and making it really structurally integral to the airbag, we decided to build the airbag structure, the inflated portion of it, separately with very little abrasion material on it, and build the abrasion layers as a completely separate item, like a wig, and drop it down on top of the airbag, and stitch it in places locally, spot bond it, or spot attach it. Fundamentally a different way of doing things, and they are sort of backup options, if you will, "reserves," because most of those cost us more mass... except for the Wig, that one actually saves us some mass, but they are different, so we would only incorporate them if we really had to.

P2K: So after October it was really "back to the drawing boards"?

Tom Rivellini: I would not so much call it "going back to the drawing board"... But I would call it making a paradigm shift in how you actually make the airbag work.

P2K: But you are back to innovating: the rovers turn out not to be a "done deal"?

Tom Rivellini: We are definitely innovating again with the airbags. Partly it's because, you know, originally we tried to save some mass, and we went to lighter weight fabric, and that may or may not have propagated, or caused some of these failure modes to start happening.

We still think that making that decision was the right thing to do, but that just means we have to make some fixes to address the problems that we are now seeing. And just due to the fact that time is of the essence, we've got blackout windows when we can't go into the chamber, and the rovers launch date is coming up real fast, we're going in with a "Plan B", hoping we don't have to use it, but we're going in with a "Plan B" in our back pockets. And that's where the innovation happens, is with a "Plan B" airbags.

P2K: How will you know that things are on track in the next set of tests?

Tom Rivellini: Airbag drop testing is sort of "Go / No Go." I mean there's not a lot of ambiguity. If you break through your abrasion layers and you cut a hole in the bladder, it's pretty well set that you got a problem. So, fortunately, there's not a lot of ambiguity. It's when you get little tears, and you broke through most of your abrasion layer, and you start to scratch the bladder, that you got to scratch your head a little bit but we don't see a lot of that.

P2K: To what extent do the airbags give the mission, literally and metaphorically, a "cushion" of safety... in some ways the airbags are the margin, right?

The airbags provide a lot of performance capability for the landing system to allow it to go into some pretty challenging areas. What makes it difficult to actually use all that margin, and be really aggressive in the landing site selection, is that we have to test the airbags out to the 99% percentile landing case, where we figure 80% of the time we've going to be landing under very, very benign conditions for the airbags, so in theory you could really drop that thing on some pretty big ugly rocks. But unfortunately there is 5-10-15% of the time where the RAD rockets, or the winds, or the landing environments cause you to land with pretty high horizontal velocity, and that's where we have to do all of our testing. And so then it becomes sort of a gambling kind of thing: do you want to take the chances that you are not going to experience those types of high velocities, and go to a very challenging site? Or do you want to be conservative in your landing site selections, so that even if you did hit those high-velocity landing conditions, you'd still be safe?

P2K: Do you have enough time, and budget, and testing days to do all the tests you want to do?

Tom Rivellini: You know, the Mars Exploration Rovers mission has a little bit different philosophy from a risk standpoint, from what Pathfinder did. In Pathfinder we were very wiling to take risk. It was sort of told to us, "Thou Shalt Take Risk" to make this mission happen. The Mars Exploration Rovers mission is a little bit different, there is a lot more at stake here. We are coming off the two failures of a couple of missions, and so the risk posture is not quite as liberal as it was in Pathfinder, so the notion of wanting to do more tests, and having enough time to do more tests, I think we are always going to want to do more tests on the rovers. Because the more you test the more risk you can eliminate. You will never be able to eliminate risk completely with testing. But the more testing the better from a risk standpoint, so we're always going to want to test.

P2K: Is the Mars Exploration Rovers mission any less fun than Pathfinder?

Tom Rivellini: You know I just started working on the Mars Exploration Rovers mission full time in the last 6 months, but all of my colleagues are working the mission, and I got the distinct impression that it is a lot more stressful than Pathfinder was. Not to say that Pathfinder wasn't stressful, but... for some reason... well... let me back up.

People on the Mars Exploration Rovers mission are a lot more stressed than on Pathfinder, and I think the key issue there is really the schedule. You know, people know how to do their job; they know what they need to do for the most part. It's just that there is not enough time to do the job as completely as people really want to do. I mean, people are having to start the fabrication of their hardware before they are done designing the hardware. That's really nerve-wracking, because when that part fails, it's like that soldier in the frontline who drops the ball. People are counting on him to succeed. And so it puts a lot of pressure on people.

But you know, the project and the Lab (JPL) are trying to fill in with as much support, as much senior level expertise coming in to help people, pulling people out of retirement to do a lot of hand-holding, and that's a good thing, because everybody needs their hand held at some point. (Laughs) No matter how senior people think they are around here, there are more senior people who have retired! So, you know, I think as deadlines start to come, and people start to make their deliveries, I think the mood, hopefully will get a little bit better.

P2K: You were also part of the review of the Beagle spacecraft (ESA's current Mars lander mission.) How unique is JPL's or NASA's approach?

Tom Rivellini: The Beagle II spacecraft... it's a very interesting experience watching those guys in action. Very, very different attitude. It was much more of a Mars Pathfinder type approach than a Mars Exploration Rovers type approach. That was a much smaller team, it was a university level development initially, and slowly ESA and governments are getting involved, but at the point that we went there to see what they were doing it was still very much a university style research project. You know, glorified... they had a lot of professional aerospace contractors on board, but nonetheless the willingness to accept risk, and the workforce and the budgets that they were working with - very different than the way the Mars Exploration Rovers mission is operating. They were doing a heck of a job. They were doing some really fine work, and they are a smart bunch of guys. They took everything that we did on Pathfinder and started with that. They were not trying to re-invent the wheel, for the most part. Configurationally, architecturally, their airbag design was a derivative of the Russian airbag design, which unfortunately never got a chance to work on Mars. But that's what they started off with as opposed to something more Pathfinder-like.

P2K: When you started off on Pathfinder, airbags had to be invented from scratch... where do airbags sit in comparison to retrorockets in terms of missions to Mars. What's the status of airbags today, do you think?

Tom Rivellini: Airbag development, compared to, say, parachute development, I mean airbags are today where parachutes may have been 20-30 years ago. I mean we are just learning about airbags. We built one airbag system, Mars Pathfinder - many versions of it, but it's still one system - and so we have not really gotten off the design point to see how bigger bags or smaller bags really work. Even with the one system, we're still learning stuff today: we're doing more tests, and we're learning new stuff.

Compared to retro-rockets? Retro-rockets for landing on other planets are actually a lot easier to do. The control systems, they're pretty well understood: they're very challenging, very difficult to do, but they are well understood: there are no leaps in technology, there are no leaps of faith that have to happen there. What happens with soft landers is that you've got little legs, and those little legs may or may not want to land on big rocks or slopes, and that's where the challenge comes in.

What I was trying to say was that compared to parachutes the state of airbag development is where parachutes were 20 years ago. The difference being that with an airbag system you just bounce over your hazards: we call it "hazard tolerance" as opposed to "hazard avoidance," with retro-rockets and little legs you want to steer away from them, and that's the hard part...