So their model of the spacecraft behavior allowed for the possibility of the altitude instantly changing from 3.7km to a negative value. Seems like poor design.
Their system design accepted data from a number of sensors, and allowed for the possibility of sensor error.
In a hypothetical scenario, if one of those altitude sensors used barometric pressure, then a piece of grit or ice could have blocked the air intake, allowing the sensor to record a lower pressure than expected. If that grit or ice were suddenly blown away, then the sensor could record an instant change from an incorrect value (3.7km altitude) to a correct value. Even a negative altitude isn't necessarily incorrect, if the "altitude" is based on a mean ground level. For example, the shore of the Dead Sea is at an altitude of -423m [1].
The challenge with designing something like this is to imagine all the possible ways it could fail, all the possible misleading sensors inputs, and an appropriate action for each of them.
Thank you, and that's a really interesting question.
There are really two concepts in there: the idea of "sea level", and the idea of "altitude", which we generally understand to be height above or below sea-level, but in some circumstances is only tangentially related to sea-level.
Most current geospatial representations use the WGS84 projection, which is the projection used by the original USA GPS system called Navstar.
WGS does get revised every now and again. The last revision was in 2004. However, the concept of WGS is built around an imaginary idealised ellipsoid that represents the shape of the Earth's surface and the Earth's gravitational field, so a change in sea-level wouldn't necessarily change the definition of WGS, and if it were to be updated, it would be slow to update.
That said, GPS is notoriously bad at reporting altitude, so tools tend not to rely on GPS for altitude measurements anyway.
A good example is in aviation. Altitude isn't measured using GPS, it's measured using barometric pressure against one of three references: either the recorded barometric pressure at a particular airfield (QFE), the corresponding barometric pressure at sea-level (QNH) or a global idealised standard barometric pressure (1013mb). During take-off or landing, the altimeter is calibrated to the airfield's barometric pressure, to accurately report the altitude above the airfield. During transition to cruising altitude, many aircraft use QNH. During general flight, altimeters are calibrated to the global standard of 1013mb, so that each aircraft maintains consistent vertical separation. Commercial aircraft flying at "Flight Level" use that standard barometric pressure to calculate altitude. For that use-case, it doesn't matter whether the reported altitude is the height above the ground, the height above mean sea-level, or the height above some arbitrary reference point: what's important is that everyone is communicating using the same reference, which is why the mean atmospheric pressure of 1013mb was adopted.
If (when?) sea-level rises, then small changes will be seen. Nautical charts will be updated with new high-water/low-water marks, maps will eventually be updated, etc. Widely-used references such as WGS84 will take a long time to update, and may not even be updated at all (because an altitude difference of 1 or 2 meters isn't hugely significant). Other reference points, such as the barometric pressure of 1013mb are unlikely to change, partly because they have a long legacy, and partly because the accuracy of the value is to a large part irrelevant.
They have to, unfortunately, because general public (including journalists) doesn't understand that mistakes happen, and ESA being seriously underfunded as it is, cannot afford bad publicity.
Also, this was a test flight designed to gather data about the performance of the orbiter/lander platform, so it did perform its mission and according to the collected data, the platform behaves mostly as expected.
they're fighting tooth and nail for this mission's successor (which will be the real deal vs what was effectively an expensive acceptance test run) to not be canceled, i.e. politics.
In a hypothetical scenario, if one of those altitude sensors used barometric pressure, then a piece of grit or ice could have blocked the air intake, allowing the sensor to record a lower pressure than expected. If that grit or ice were suddenly blown away, then the sensor could record an instant change from an incorrect value (3.7km altitude) to a correct value. Even a negative altitude isn't necessarily incorrect, if the "altitude" is based on a mean ground level. For example, the shore of the Dead Sea is at an altitude of -423m [1].
The challenge with designing something like this is to imagine all the possible ways it could fail, all the possible misleading sensors inputs, and an appropriate action for each of them.
[1] https://en.wikipedia.org/wiki/List_of_places_on_land_with_el...