Safety-Critical Software Engineering for the Most Complex Robotic Spaceflight NASA Ever Attempted.

Did life exist on Mars?

The Mars Sample Return program exists to answer a question humanity has never been able to answer before: did life exist on Mars? NASA’s Perseverance rover has been collecting rock, soil, and atmospheric samples since landing in Jezero Crater in February 2021. Getting them back to Earth, intact, in sequence, without a single system failure, is the engineering problem.

The Sample Retrieval Lander will be the largest spacecraft yet sent to Mars. It carries the Mars Ascent Vehicle, two retrieval helicopters, and the robotic arm that transfers samples into the rocket. When it launches from the Martian surface, it will be the first launch ever from the surface of another planet. MSR will also be the first mission to return scientifically selected samples from another planet. The program is under direct congressional cost oversight. It is the top priority in the 2023, 2032 Planetary Science Decadal Survey.

There is no ground crew on Mars. There is no patch window. There is no second attempt.

A test rack failure on Earth is a mission failure on Mars.

Before any hardware leaves Earth, every system on the SRL must be validated against conditions it will face hundreds of millions of miles away: thermal extremes, communications latency, surface terrain, and failure scenarios that cannot be replicated in any single facility on this planet.

The fundamental problem with testing flight hardware for an interplanetary mission is that the environment you’re testing for is the one place you can’t test in. Every failure mode that isn’t found in the lab gets discovered on Mars.

For a program at this cost and consequence level, that’s not an acceptable risk profile.

Three interlocking areas of responsibility.

Geisel Software designed and developed the test rack infrastructure used to validate the SRL’s flight hardware and software. The work spanned three interlocking areas of responsibility.

Flight Hardware Validation for Safety-Critical Autonomous Systems

The test racks had to accurately emulate the flight conditions the SRL would face on Mars, not approximate them. That meant designing for the full range of harsh Martian environmental conditions the hardware would encounter, and ensuring that every scenario the system might face could be replicated and validated on the ground. The rigor of that design work directly determined the reliability of the mission. Hardware that hasn’t been tested against what it will actually face isn’t validated, it’s assumed. Geisel built the infrastructure that made real validation possible.

Iterative Testing to Zero-Failure Engineering Standards

Development of the test racks was iterative by design. Extensive testing cycles ran continuously, with each pass surfacing risk and each refinement reducing it. Every aspect of the SRL’s functionality had to be tested under the most demanding conditions achievable on Earth. That wasn’t a single-pass process, it was a sustained engineering effort to drive the probability of in-mission failure as close to zero as the ground environment would allow. For a system operating 140 million miles from the nearest repair team, that standard isn’t optional.

Embedded Systems Integration Across Flight Hardware and Software

Geisel worked closely with the teams responsible for direct flight hardware interface code throughout development, ensuring seamless integration and functionality across all components. The coordination was essential: component-level testing only gets you so far. What matters is how the full system behaves. Geisel’s involvement at the integration layer meant the validation reflected how the SRL would actually perform, not how individual components behaved in isolation.