AOCS FDIR : CONCEPT AND ITS CONCURRENT SATELLITE DESIGN IMPLEMENTATION

摘要

Autonomous management of failures is a necessary and generally applied technique for all kinds of spacecraft.Particularly in Europe, this technique is called "FDIR" (i.e. Failure Detection, Isolation and Recovery). Its primarypurpose is -- analogue to an immune system -- "safety of live". Its secondary purpose is "improvement of functionalavailability". According to its purposes, FDIR was often assigned as belonging to Product Assurance or to RAMS.Correspondingly its development and implementation typically comes late, as a kind of "add on" to an existing design.Thus in the most part a spacecraft design is handled by FDIR -- but the design itself is not necessarily suitable for faultmanagement processes. Such system shortcomings can be avoided by involving FDIR from the very beginning, parallelto subsystems and software development. This paper addresses a method of developing, implementation and integrationof FDIR into the satellite software, so that fault management becomes an integral part of the development process. TheAOCS Subsystem, as one of the most critical and most complex aboard a satellite, is taken as an example, to illustratethe architecture, the principles and the advantages of this approach. A methodology for failure detection for the AOCSunits and processes is also presented. Further on, the connected aspects for interfaces, organization and responsibilitiesare shortly addressed.