Fault Protection Design and Testing For the Cassini Spacecraft In A “Mixed” Thruster Configuration

Abstract

NASA's Cassini Spacecraft, launched on October 15 th , 1997 and arrived at Saturn on June 30 th , 2004, is the largest and most ambitious interplanetary spacecraft in history. In order to meet the challenging attitude control and navigation requirements of the orbit profile at Saturn, Cassini is equipped with a monopropellant thruster based Reaction Control System (RCS), a bipropellant Main Engine Assembly (MEA) and a Reaction Wheel Assembly (RWA). In 2008, after 11 years of reliable service, several RCS thrusters began to show signs of end of life degradation, which led the operations team to successfully perform the swap from the A-branch to the B-branch RCS system. If similar degradation begins to occur on any of the B-branch thrusters, Cassini might have to assume a "mixed" thruster configuration, where a subset of both A and B branch thrusters will be designated as prime. The Cassini Fault Protection FSW was recently updated to handle this scenario. The design, implementation, and testing of this update is described in this paper. Nomenclature AACS = Attitude and Articulation Control Subsystem AFC = Attitude Control Flight Computer CBH = Catbed Heater DOY = Day of Year ETC = Excessive Thruster Commanding FP = Fault Protection FSDS = Flight Software Development Suite FSW = Flight Software GSW = Ground Software ITL = Integrated Test Laboratory LV = Latch Valve MEA = Main Engine Assembly MPD = Mono-propellant Driver Unit MTA = Mono-propellant Tank Assembly OTM = Orbit Trim Maneuver RCS = Reaction Control System RWA = Reaction Wheel Assembly S/C = Spacecraft VDECU = Valve Driver Electronics Controller Unit

Cassini Attitude and Articulation Control Subsystem Fault Protection Challenges During Saturn Proximal Orbits

“…A multitude of testing was performed on the Flight Software Development System to verify the proper fault protection responses in a mixed branch RCS control mode 8 . These tests all assumed a nominal power margin, however, and as such, both branches of catbed heaters-the 'A' branch secondary, and the 'B' branch primary, were commanded in the auto mode.…”