NASA NTRS2005
On November 5, 2001, a processor reset occurred on board the Microwave Anisotropy Probe (MAP), a NASA mission to measure the anisotropy of the microwave radiation left over from the Big Bang. The reset caused the spacecraft to enter a safehold mode from which it took several days to recover. Were that to happen regularly, the entire mission would be compromised, so it was important to find the cause of the reset and, if possible, to mitigate it. NASA assembled a team of engineers that included experts in radiation effects to tackle the problem. The first clue was the observation that the processor reset occurred during a solar event characterized by large increases in the proton and heavy ion fluxes emitted by the sun. To the radiation effects engineers on the team, this strongly suggested that particle radiation might be the culprit, particularly when it was discovered that the reset circuit contained three voltage comparators (LM139). Previous testing revealed that large voltage transients, or glitches appeared at the output of the LM139 when it was exposed to a beam of heavy ions [NI96]. The function of the reset circuit was to monitor the supply voltage and to issue a reset command to the processor should the voltage fall below a reference of 2.5 V [PO02]. Eventually, the team of engineers concluded that ionizing particle radiation from the solar event produced a negative voltage transient on the output of one of the LM139s sufficiently large to reset the processor on MAP. Fortunately, as of the end of 2004, only two such resets have occurred. The reset on MAP was not the first malfunction on a spacecraft attributed to a transient. That occurred shortly after the launch of NASA s TOPEX/Poseidon satellite in 1992. It was suspected, and later confirmed, that an anomaly in the Earth Sensor was caused by a transient in an operational amplifier (OP-15) [KO93]. Over the next few years, problems on TDRS, CASSINI, [PR02] SOHO [HA99,HA01] and TERRA were also attributed to transients. In some cases, such events produced resets by falsely triggering circuits designed to protect against over- voltage or over-current. On at least three occasions, transients caused satellites to switch into "safe mode" in which most of the systems on board the satellites were powered down for an extended period. By the time the satellites were reconfigured and returned to full operational state, much scientific data had been lost. Fortunately, no permanent damage occurred in any of the systems and they were all successfully re-activated.