> This in turn successively triggered a premature release of the parachute and the backshell, a brief firing of the braking thrusters and finally activation of the on-ground systems as if Schiaparelli had already landed.
It would have been better to do nothing, in the hope that the altimeter data will resume to reasonable values, especially since the article mentions that the error is not supposed to last long:
> Its output was generally as predicted except for this event, which persisted for about one second – longer than would be expected.
All inputs and outputs should be run through sanity checks, with a plan for when they go wrong.
Essentially, when you've got a system that can't be fixed, plan for failure of each and every component (in isolation).
... and that was a single sensor out.
This is not a new idea. Airplanes cannot fly without instruments, and all the instruments have backups and alternate means. Everything deemed "flight critical" has a backup alternative.
My friend's Honda literally stopped combustion when his battery died while driving (no, I have no idea how, but that was the diagnosis).
In contrast, I've limped my Miata along on alternator-only when the battery wouldn't hold a charge. Note: feathering the gas at a stop with brakes and clutch depressed to keep your spark from dying is an "interesting" experience.
More fun is driving a vehicle with no clutch: stalling at every stop and starting the motor in first gear, and shifting without clutching. I had to do that in my '83 280ZX in its last days.
They weren't telling that. As far as I understood, the sensors were fully right, the software just hasn't expected the rotation to last "so long" -- the whole second, so it calculated the result wrong ("negative height") by incorrectly processing these multiple (in time) for their model unexpected inputs.
If radar altimeter had never had a lock, either the radar altimeter has faulted in a way you can't detect, or you are above the lock range for your radar altimeter.
If the radar altimeter had locked, you have a very accurate measurement of height above ground.
It would also require you to anticipate the malfunction in which case you already know that things like that could happen, in which case you'd likely determine how it could happen and how to avoid it and continue having useful data. Sounds to me like a better solution than trying to recover without data.