SEARCH · Engineering Papers

Results for “safe mode”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records

All sources NASA NTRS DOE OSTI

NASA NTRS2018

Modeling Spacecraft Safe Mode Events

Spacecraft enter a ‘safe mode’ to protect the vehicle when a potentially harmful anomaly occurs. This minimally functioning state isolates faults, establishes contact with Earth, and orients the vehicle into a power positive attitude until operators intervene. Though ‘safings’ are inherently unpredictable, mission teams build in time margin during operations to determine root causes and restore functionality. Planning and managing this margin is both critical and enabling on mission architectures dependent on near-continuous operability – such as a low-thrust electric propulsion mission. To better quantify the occurrences and severity of safe mode anomalies, the Jet Propulsion Laboratory (JPL) has assembled a database of safings from past and active missions. Currently nearly 240 records are captured from 21 beyond-Earth missions, stemming from a collaboration between teams at JPL, Ames Research Center, Goddard Space Flight Center, and the Johns Hopkins University Applied Physics Laboratory. This paper discusses the event database, explores a statistical approach in modeling the occurrences and severity of safing events, presents a simulation technique, and details recommendations and future work to benefit future concepts.

Nicholas, Austin↗

NASA NTRS2010

Lunar Reconnaissance Orbiter (LRO) Sun Safe Mode

The Lunar Reconnaissance Orbiter (LRO), a spacecraft designed and built at the National Aeronautics and Space Administration s (NASA) Goddard Space Flight Center (GSFC) in Greenbelt, MD, was launched on June 18, 2009 from Cape Canaveral. It is currently in orbit about the Moon taking detailed science measurements and providing a highly accurate mapping of the suface in preparation for the future return of astronauts to a permanent moon base. Onboard the spacecraft is a complex set of algorithms designed by the attitude control engineers at GSFC to control the pointig for all operational events, including anomalies that require the spacecraft to be put into a well known attitude configuration for a sufficiently long duration to allow for the investigation and correction of the anomaly. GSFC level requirements state that each spacecraft s control system design must include a configuration for this pointing and lso be able to maintain a thermally safe and power positive attitude. This stable control algorithm for anomalous events is commonly referred to as the safe mode and consists of control logic thatwill put the spacecraft in this safe configuration defined by the spacecraft s hardware, power and environment capabilities and limitations. The LRO Sun Safe mode consists of a coarse sun-pointing set of algorithms that puts the spacecraft into this thermally safe and power positive attitude and can be achieved wihin a required amount of time from any initial attitude, provided that the system momentum is within the momentum capability of the reaction wheels. On LRO the Sun Safe mode makes use of coarse sun sensors (CSS), an inertial reference unit (IRU) and reaction wheels (RW) to slew the spacecraft to a solar inertial pointing. The CSS and reaction wheels have some level of redundancy because of their numbers. However, the IRU is a single-point-failure piece of hardware. Without the rate information provided by the IRU, the Sun Safe control algorithms could not maintain the required pointing, so a sub-mode of the Sun Safe mode that does not use the IRU was designed. This submode, referred to as the Sun Safe Gyroless control mode, consists of an algorithm that estimates rate information from the CSS and the RW measurements. RW momentum information is used to estimate the body rate parallel to the target sunline, which CSS alone would not be able to observe. Sun Safe can be autonomously, or via ground command, entered from any other control mode and in the event the IRU is not providing rate information, the control mode is switched to the gyroless submode. This paper looks at the design of the Sun Safe modes and discusses the constraints placed on the algorithm and how the mode wored around these constraints. Items of particular interest include CSS placement on the Solar Array (SA) and its implications to design, estimation of body rate information for the Sun Safe Gyroless control mode, and the effect of solar eclipse on each of the Sun Safe modes. Placing CSS on the SA was necessary for the means to put the Sun along the targeted sun-line, nominally normal to the SA panels, for all operational considerations. This had design implications for determining a sun vector during normal SA operations, if one or both gimbals become inoperable and when the SA is in a stowed configuration. The ability of body rate estimation in Sun Safe Gyroless not only uses CSS sun vector data but requires RW momentum measuremens to estimate rates parallel to the sun-line. LRO encounters solar eclipses of some length for most of its orbits about the Moon. With the lack of CSS measurement data a design was implemented in both Sun Safe and Sun Safe Gyroless, they differ because of having or not having IRU measurement data, to carry the spacecraft through these eclipse periods. This paper also includes some discussion of sun avoidance and how it affected design decisions during nominal and eclipse perids for each of the Sun Safe modes.

Garrick, Joseph↗

NASA NTRS2010

Managing Cassini Safe Mode Attitude at Saturn

The Cassini spacecraft was launched on October 15, 1997 and arrived at Saturn on June 30, 2004. It has performed detailed observations and remote sensing of Saturn, its rings, and its satellites since that time. In the event safe mode interrupts normal orbital operations, Cassini has flight software fault protection algorithms to detect, isolate, and recover to a thermally safe and commandable attitude and then wait for further instructions from the ground. But the Saturn environment is complex, and safety hazards change depending on where Cassini is in its orbital trajectory around Saturn. Selecting an appropriate safe mode attitude that insures safe operation in the Saturn environment, including keeping the star tracker field of view clear of bright bodies, while maintaining a quiescent, commandable attitude, is a significant challenge. This paper discusses the Cassini safe table management strategy and the key criteria that must be considered, especially during low altitude flybys of Titan, in deciding what spacecraft attitude should be used in the event of safe mode.

Attitude Control↗

NASA NTRS2021

Design of Solar Sailing Trajectories Resilient to Safe Mode Events

Solar sails are an enabling technology for stand-alone small-satellite deep-space exploration. However, their always-on nature, combined with the time of flight required for deep-space missions, makes them particularly susceptible to safe mode events. Unlike missions using electric propulsion, exclusively solar sail- ing missions cannot carry extra propellant to make up for a safe mode event, and more powerful methods like expected availability cannot be directly applied. This work extends the expected availability and duty cycle approaches to solar sailing. Through an application to NASA’s Solar Cruiser mission, a 46 % increase in tra- jectory resilience is obtained at negligible change in the mission’s time of flight. Additionally, it is shown that when a safe mode event stops the spacecraft from reaching its target orbit, the developed methods reduce the expected final error by approximately an order of magnitude.

Johnson, Les↗

NASA NTRS2015

Sun Safe Mode Controller Design for LADEE

This paper presents the development of sun safe controllers which are designed to keep the spacecraft power positive and thermally balanced in the event an anomaly is detected. Employed by NASA's Lunar Atmosphere and Dust Environment Explorer (LADEE), the controllers utilize the measured sun vector and the spacecraft body rates for feedback control. To improve the accuracy of sun vector estimation, the least square minimization approach is applied to process the sensor data, which is proven to be effective and accurate. To validate the controllers, the LADEE spacecraft model engaging the sun safe mode was first simulated and then compared with the actual LADEE orbital fight data. The results demonstrated the applicability of the proposed sun safe controllers.

Sun Safe Control↗

NASA NTRS2018

A Monte Carlo Approach to Measuring Trajectory Performance Subject to Missed Thrust

A spacecraft using solar electric propulsion (SEP) to reach its destination must operate its thrusters for very long periods of time compared to one using chemical propulsion. Some spacecraft may be required to thrust almost the entire duration of the transfer to reach their target. A side-effect of this characteristic of SEP missions is that a spacecraft could be subject to an anomaly or fault that forces it to stop thrusting when it should be, causing it to drift away from its nominal trajectory. A diagram of this situation is shownin Figure 1. Because these shut-down events (commonly referred to as safe mode or safing events), are not uncommon and can be caused by uncontrollable external factors (such as a cosmic ray striking an electronic component), the spacecraft and trajectory should be designed such that the spacecraft can continue on to its destination in a reasonable time and propellant expenditure once operations resume.

Laipert, Frank E.↗

NASA NTRS1989

Design of the TOPEX Earth Pointing Safe Hold Mode

A technical description of the design and analysis of the Earth Pointing Safe Hold mode (EPSHM) for the Ocean Topography Experiment (TOPEX) satellite is presented. The EPSHM serves as the primary hardwired analog backup controller for safe-haven satellite operations in the event of on-orbit anomalies. The EPSHM is a modified version of the baseline Multimission Modular Satellite (MMS) EPSHM used on the Landsat-4 mission. Modifications to the MMS baseline EPSHM used on Landsat-4 were required to satisfy the unique TOPEX operational requirements. One such TOPEX operational requirement is that the EPSHM provide a spacecraft yaw-axis slewing capability to maintain adequate illumination of the solar array. The EPSHM architecture, constituent hardware components, performance requirements and predicted on-orbit performance are described.

Dennehy, C. J.↗

NASA NTRS2006

Evolution of the Hubble Space Telescope Safing Systems

The Hubble Space Telescope (HST) was launched on April 24 1990, with an expected lifespan of 15 years. Central to the spacecraft design was the concept of a series of on-orbit shuttle servicing missions permitting astronauts to replace failed equipment, update the scientific instruments and keep the HST at the forefront of astronomical discoveries. One key to the success of the Hubble mission has been the robust Safing systems designed to monitor the performance of the observatory and to react to keep the spacecraft safe in the event of equipment anomaly. The spacecraft Safing System consists of a range of software tests in the primary flight computer that evaluate the performance of mission critical hardware, safe modes that are activated when the primary control mode is deemed inadequate for protecting the vehicle, and special actions that the computer can take to autonomously reconfigure critical hardware. The HST Safing System was structured to autonomously detect electrical power system, data management system, and pointing control system malfunctions and to configure the vehicle to ensure safe operation without ground intervention for up to 72 hours. There is also a dedicated safe mode computer that constantly monitors a keep-alive signal from the primary computer. If this signal stops, the safe mode computer shuts down the primary computer and takes over control of the vehicle, putting it into a safe, low-power configuration. The HST Safing system has continued to evolve as equipment has aged, as new hardware has been installed on the vehicle, and as the operation modes have matured during the mission. Along with the continual refinement of the limits used in the safing tests, several new tests have been added to the monitoring system, and new safe modes have been added to the flight software. This paper will focus on the evolution of the HST Safing System and Safing tests, and the importance of this evolution to prolonging the science operations of the telescope.

Pepe, Joyce↗

NASA NTRS1998

The Recovery of TOMS-EP

On December 13th 1998, the Total Ozone Mapping Spectrometer - Earth Probe (TOMS-EP) spacecraft experienced a Single Event Upset which caused the system to reconfigure and enter a Safe Mode. This incident occurred two and a half years after the launch of the spacecraft which was designed for a two year life. A combination of factors, including changes in component behavior due to age and extended use, very unfortunate initial conditions and the safe mode processing logic prevented the spacecraft from entering its nominal long term storage mode. The spacecraft remained in a high fuel consumption mode designed for temporary use. By the time the onboard fuel was exhausted, the spacecraft was Sun pointing in a high rate flat spin. Although the uncontrolled spacecraft was initially in a power and thermal safe orientation, it would not stay in this state indefinitely due to a slow precession of its momentum vector. A recovery team was immediately assembled to determine if there was time to develop a method of despinning the vehicle and return it to normal science data collection. A three stage plan was developed that used the onboard magnetic torque rods as actuators. The first stage was designed to reduce the high spin rate to within the linear range of the gyros. The second stage transitioned the spacecraft from sun pointing to orbit reference pointing. The final stage returned the spacecraft to normal science operation. The entire recovery scenario was simulated with a wide range of initial conditions to establish the expected behavior. The recovery sequence was started on December 28th 1998 and completed by December 31st. TOMS-EP was successfully returned to science operations by the beginning of 1999. This paper describes the TOMS-EP Safe Mode design and the factors which led to the spacecraft anomaly and loss of fuel. The recovery and simulation efforts are described. Flight data are presented which show the performance of the spacecraft during its return to science. Finally, lessons learned are presented.

Robertson, Brent↗

NASA NTRS2011

Space Environments Testbed

The Space Environments Testbed (SET) is a flight controller data system for the Common Carrier Assembly. The SET-1 flight software provides the command, telemetry, and experiment control to ground operators for the SET-1 mission. Modes of operation (see dia gram) include: a) Boot Mode that is initiated at application of power to the processor card, and runs memory diagnostics. It may be entered via ground command or autonomously based upon fault detection. b) Maintenance Mode that allows for limited carrier health monitoring, including power telemetry monitoring on a non-interference basis. c) Safe Mode is a predefined, minimum power safehold configuration with power to experiments removed and carrier functionality minimized. It is used to troubleshoot problems that occur during flight. d) Operations Mode is used for normal experiment carrier operations. It may be entered only via ground command from Safe Mode.

Leucht, David K.↗

NASA NTRSDate not supplied

Monitoring the Calibration of the DSCOVR EPIC Instrument’s Visible Cchannels Using MODIS and VIIRS as a Reference

The Earth Polychromatic Imaging Camera (EPIC) instrument aboard the Deep Space Climate Observatory (DSCOVR) satellite has a constant unique view of the sunlit disk of the Earth from the Lagrange-1 (L1) point nearly a million miles away from the Earth. Due to EPIC not having any on-board calibration systems, the ten spectral channels of EPIC must be inter-calibrated using vicarious on-orbit methods, such as ray-matching with well-calibrated low Earth orbiting satellites like the Aqua-MODIS and SNPP-VIIRS radiometers. The recently released EPIC version 3 L1B data has greatly enhanced the residual navigation errors found in prior versions, thereby decreasing the calibration uncertainty in the aforementioned ray-matching calibration techniques. The automated navigation correction used by these ray-matching methods for further improving the EPIC geolocation will be compared with a new navigation correction method utilizing optical flow between the EPIC and MODIS/VIIRS images. The DSCOVR satellite went into safe mode on June 27, 2019 due to an anomaly with the satellite’s attitude control system, but operations recommenced on March 2, 2020. The calibration of the EPIC instrument before it went into safe mode and after it resumed will be analyzed in order to investigate any potential calibration shifts or discontinuities caused by the spacecraft anomaly.

Conor Haney↗

NASA NTRS2012

Safehold Attitude Determination Approach for GPM

Spacecraft sating designs generally have minimal goals with loose pointing requirements. Safe pointing orientations for three-axis stabilized spacecraft are usually chosen to put the spacecraft into a thermally safe and power-positive orientation. In addition, safe mode designs are required to be simple and reliable. This simplicity lends itself to the usage of analog sun sensors, because digital sun sensors will add unwanted complexity to the safe hold mode. The Global Precipitation Measurement (GPM) Mission Core Observatory will launch into lower earth orbit (LEO) at an inclination of 65 degrees. The GPM instrument suite consists of an active radar system and a passive microwave imager to provide the next-generation global observations of rain and snow. The complexity and precision of these instruments along with the operational constraints of the mission result in tight pointing requirements during all phases of the mission. To ensure the instruments are not damaged during spacecraft safing, thermal constraints dictate that the solar pointing orientation must be maintained to better than 6.5 degrees. This requirement is outside the capabilities of a typical analog sun sensor suite, primarily due to the effects of Earth's albedo. To ensure mission success, a new analog sensor, along with the appropriate algorithms, is needed. This paper discusses the design issues involving albedo effects on spacecraft pointing and the development of a simple, low-cost analog sensor and algorithm that will address the needs of the GPM mission. In addition, the algorithms are designed to be easily integrated into the existing attitude determination software by using common interfaces. The sensor design is based on a heritage, commercial off-the-shelf analog sun sensors with a limited field-of-view to reduce the effects of Earth's albedo. High fidelity simulation results are presented that demonstrate the efficacy of the design.

Fitzpatrick, Henry↗

NASA NTRS1988

Telescope protection algorithm for the Space Infrared Telescope Facility

This paper presents a proposed on-board Telescope Protection Algorithm (TPA) for the Space Infrared Telescope Facility (SIRTF). This TPA consists of hardware and software capable of performing both fail-operational and fail-safe modes of operation. In the fail-operational mode, each ephemeris load and slew/dwell command sequence is checked on-board before use. The slew command monitor detects unallowable slew/dwell commands and transfers control to an algorithm which slews to and maintains a safe telescope orientation while preserving precise attitude determination and control. This fail-operational mode is also given the authority to autonomously restart the slew/dwell sequence at a point beyond the faulty command. The fail-safe system consists of software and hardware which detects impending earth, moon, or sun avoidance zone violations and activates a backup hardware safe hold mode. The subject TPA and relevant sensor complement were designed for the SIRTF mission; however, this system can easily be used as a basis for failure detection and correction in a wide range of other missions.

Class, B. F.↗

NASA NTRS2016

Identification and Reconfigurable Control of Impaired Multi-Rotor Drones

The paper presents an algorithm for control and safe landing of impaired multi-rotor drones when one or more motors fail simultaneously or in any sequence. It includes three main components: an identification block, a reconfigurable control block, and a decisions making block. The identification block monitors each motor load characteristics and the current drawn, based on which the failures are detected. The control block generates the required total thrust and three axis torques for the altitude, horizontal position and/or orientation control of the drone based on the time scale separation and nonlinear dynamic inversion. The horizontal displacement is controlled by modulating the roll and pitch angles. The decision making algorithm maps the total thrust and three torques into the individual motor thrusts based on the information provided by the identification block. The drone continues the mission execution as long as the number of functioning motors provide controllability of it. Otherwise, the controller is switched to the safe mode, which gives up the yaw control, commands a safe landing spot and descent rate while maintaining the horizontal attitude.

Unmanned aerial system↗

NASA NTRS2008

Deep Space Mission Emergency Mode Downlink

This paper investigates telecommunications between a deep space mission satellite and the ground station during an emergency mode. Once emergency is detected, spacecraft is put into a safe mode, i.e., antenna to be used for emergency mode communications is pointed towards the sun and use total available power to transmit. There are many parameters affecting communications in this mode and these should be properly balanced to produce desired results. This paper explores the effectiveness of spacecraft antenna gain pattern in the emergency mode with respect to positions of the spacecraft, earth, Sun Earth Probe (SEP) angle at the receiving antenna, and the range of the spacecraft with respect to the ground station. The paper also provides parabolic reflector antenna diameter that should be used for emergency mode as a function of the satellite to sun range in the solar system.

Kantak, Anil V.↗

NASA NTRSDate not supplied

Firmware Architecture of the ARMADAS Bolting Robot

The Automated Reconfigurable Mission Adaptive Digital Assembly Systems (ARMADAS) project, under development at NASA Ames Research Center, has demonstrated on-ground autonomous robotic assembly of extensive digital structures, and it is now moving forward towards in-space demonstration. The ARMADAS system comprises of the operation software, the operation user interface (opsUI), and a swarm of robots. The robotic system consists of a multitude of collaborative agents specifically designed to transport, place and bolt the building blocks, called voxels (volumetric pixels). This paper focuses on the bolting robot, referred to as Mobile Metamaterial Internal Co-Integrator (MMIC-I). MMIC-I is a battery-powered crawling robot. It navigates the structure through extension, contraction and gripping. Two distinct controller boards operate the robot's two symmetric modules, referred to as module A and B. Board A is the master board: it coordinates motion planning and motion primitives execution, hosts the WiFi client, performs periodic self-assessment and system idle check and triggers faults if anomalies are detected. Board B periodically sends a heartbeat to board A, through a wired communication channel that uses the Serial protocol. Additionally, board A's WiFi client receives heartbeat packet requests or motion/bolting commands from a dedicated server board, and acknowledges reception sending back a response heartbeat packet containing information about the overall robot status, e. g. electrical current and voltage values, target and actual angles, operating mode, fault status. Whenever a motion command is sent, the motion planning section of the firmware determines the current robot configuration, using Inertial Measurement Unit readings and the motors Pulse Width Modulation values. Afterwards, it calculates the list of primitives needed to reach the target state, and controls their execution in the proper order. MMIC-I can receive and execute motion and bolting commands only when it is in operational mode. MMIC-I has three operating modes: standby, operational and safed. Standby mode is automatically entered upon startup. While in standby mode, all motors are powered off, and the only accepted commands are the ones relative to a change of mode and heartbeat packet request. Fault detection causes the robot to automatically enter safed or standby mode. Whenever the detected fault occurs within a motion and requires immediate intervention, e. g. an over-current situation, the robot enters safed mode. Safed mode powers off all motors except for the locomotion module, thus preventing the robot from collapsing. Conversely, when the detected fault doesn't require immediate intervention (low battery warning, for instance), the robot enters standby mode after completing the ongoing motion. This paper provides a detailed discussion of MMIC-I's firmware architecture. It accurately describes the implementation approach for each module: sensor data reading, motor control and actuation, WiFi server-client communication, intra-boards Serial communication, operating modes and autonomous fault detection, motion planning, coordination and execution, etc. Moreover, in support of the software description, this paper includes a thorough characterization of MMIC-I's hardware and avionics.

In-space assembly↗

NASA NTRS2019

Sun search desgin for the Psyche spacecraft

Psyche is a scientific mission to explore the large asteroid (16) Psyche that orbits the Sun at ~3 AU. Managed by JPL, it is the first instance of Maxar’s product line of geosynchronous communication satellites being repurposed for deep space. This paper presents the design of a unique sun sensor configuration for Safe Mode of the spacecraft. It enables quick, robust, and propellant-efficient safing while leveraging sensors, avionics, and algorithms that have extensive, flight-proven heritages

Turner, Eric↗

NASA NTRS2005

MicroPPT-Based Secondary/Backup ACS for a 160-m, 450-kg Solar Sail Spacecraft

Solar sail tip-mounted, lightweight pulsed plasma thrusters (PPTs) are proposed for a secondary (or backup) attitude control system (ACS) of a 160-m, 450-kg solar sail spacecraft of the Solar Polar Imager (SPI) mission. A propellantless primary ACS of the SPI sailcraft employs trim control masses running along mast lanyards for pitch/yaw control together with roll stabilizer bars at the mast tips for quadrant tilt (roll) control. The robustness of such a propellantless primary ACS would be further enhanced by a secondary ACS utilizing tip-mounted, lightweight PPTs. The microPPT-based ACS is intended mainly for attitude recovery maneuvers from various off-nominal conditions that cannot be reliably handled by the propellantless primary ACS. However, it can also be employed for: i) the checkout or standby mode prior to and during sail deployment, ii) the post-deployment transition mode (prior to the propellantless primary ACS mode operation), iii) the solar sailing cruise mode of a trimmed sailcraft, and iv) the spin-stabilized, sun-pointing, safe mode. Although a conventional bus ACS is required for the SPI mission as the sail is jettisoned at the start of its science mission phase, the microPPT-based ACS option promises greater redundancy and robustness for the SPI mission. For other sailing missions, where the sail is never jettisoned, this secondary ACS provides a lower-cost, lower-mass propulsion for deployment control and greater redundancy than any traditional reaction-jet control system. This paper presents an overview nf the state--of-the--art microPPT technology, the design requirements of microPPTs for solar sail attitude control, and the preliminary ACS design and simulation results.

Wie, Bong↗