Modeling Spacecraft Modes for Nominal and Off-nominal Operations

摘要

Small spacecraft have limited hardware redundancy and the onboard software, ideally, is as simple as possible. Fault Management for these missions involves leveraging the functional redundancy inherent in the system. It also involves designing out bad states from which recovery is impossible. This can be accomplished through a careful definition of spacecraft modes, and "trying out" these modes under various failure scenarios involving hardware and software faults. This paper addresses basic questions about a spacecraft mode: what aspects does it encapsulate, what defines its transitions, how does it reflect the underlying physical state of the spacecraft. It shows how to capture this in an executable model that can help uncover system elements interacting in unanticipated ways. Errors, such as command sequence errors, can be injected into the model to simulate the behavior of the spacecraft.