Environmental Engineering Reference
In-Depth Information
problems, as well as a host of lesser anomalies, the flight system is provided
with an autonomous fault detection and correction (FDC) capability.
The first responsibility of the flight system's FDC is to monitor ongoing
spacecraft function. To this end, FSW analysis personnel, in conjunction with
systems engineers and operations personnel, identify a rather large number of
hardware output items and FSW-computed parameters that together provide
a thorough description of the state of the spacecraft. The FSW then samples
these values periodically and compares them to nominal and/or required val-
ues given the spacecraft operational mode. This comparison may be achieved
via simple rules and limit checks, or by running models associated with a
state-based system. Regardless of the sophistication of the approach, the re-
sult of the procedure will either be a “clean bill of health” for the spacecraft
or identification of some element not performing within a nominal envelope.
After identification of the existence of a potential problem, the FSW then
autonomously commands an appropriate corrective response. The elaborate-
ness and completeness of the corrective response vary depending both on the
nature of the problem and the degree of independence a given mission is will-
ing to allocate to the FSW. Ideally, the level of response would be a precisely
targeted correction that immediately restores the spacecraft to nominal func-
tion allowing continuance of ongoing science observations. Usually, a complete
solution of this sort will be possible only for minor anomalies, or significant
hardware problems where an autonomous switch to a redundant component or
a transition to an appropriate FSW state may be performed without incurring
additional risk. However, for most major inflight problems, the flight system's
responsibility is less ambitious. It is usually not tasked with solving the prob-
lem, but simply placing the spacecraft in a stable, protected configuration, for
example, transitioning the spacecraft (or an SI) to safemode. The spacecraft
then remains in this state while ground personnel analyze the problem and
develop and test a solution. Once this process has been completed, the flight
system is “told” what its job is with respect to implementing the solution,
and then proceeds again with conducting the mission once the solution has
been installed.
3.1.2 Satisfying Spacecraft Infrastructure Needs
In addition to its direct, active role in achieving overall mission objectives,
FSW has a key role to play as the middle-man between the ground system and
the spacecraft hardware. To serve effectively in this capacity, the FSW must
provide a user-friendly but secure command structure enabling the ground
system to make requests of the spacecraft that will be carried out precisely,
and yet will not simply be acted on mindlessly in a manner that might put the
spacecraft at risk. Further, to ensure the spacecraft is capable of responding to
these requests in a timely manner, the FSW performs those routine functions
necessary to keep the spacecraft available and in near-nominal operational
condition.
