This paper describes the process used in 2012 by a combined mission Operations Team from the Jet Propulsion Lab and Lockheed Martin Civil Space to successfully upgrade and certify all-stellar attitude determination flight software first included in the as-launched, flight software image of Mars Odyssey 2001. It provides background on why this attitude determination flight software was not completely verified prior to launch and yet had prudently been included in the as-launched FSW image. All-stellar attitude determination was re-considered in 2012 as an alternative to gyro-based attitude determination after the A-side inertial measurement unit's laser intensity monitor exhibited a typical, near-end-of-life signature. After several reviews of the original all-stellar requirements, software design and test results, mission operations engineers concluded that the all-stellar flight software had successfully completed requirements, design, code, and unit testing but had been intentionally and with customer approval, de-scoped prior to completing system verification. This paper also relates how that while completing the previously de-scoped system verification tests of all-stellar AD, the Operations Team discovered a design defect in the original flight software as well as limitations with the star camera which is the primary component for All-Stellar. It describes the rigorous process followed by the Operations Team to build and test a patch to the Odyssey flight software that enabled the successful transition from gyro-based to all-stellar attitude determination. Subsequently, the A-side inertial measurement unit was powered off, prolonging the life of this spacecraft component. The paper concludes with a discussion of how the operations model employed by the combined mission Operations Teams enabled the successful, albeit unorthodox, correction and verification of previously de-scoped flight software included in an as-launched, but never completely verified flight - oftware image.
展开▼
