OPS-SAT: FDIR design on a mission that expects bugs - And lots of them

Abstract

This paper describes the unique Fault Detection, Isolation and Recovery (FDIR) concept of the ESA OPS-SAT project. OPS-SAT is ESA’s first nanosatellite mission and is the first mission world-wide to be designed exclusively to demonstrate ground-breaking satellite and ground control software under real flight conditions. The FDIR system is unique in several ways not least because the mission concept involves replacing the entire on-board software suite, right down to operating system, on a daily basis. This also extends to the ground system which must be designed to be replaceable on the same time scales. The mission will deal with the very acute problem of allowing experimenters to load on a daily basis their own on-board software and ground software with minimal testing. The solution is to design the FDIR system to concentrate on ensuring survivability of the spacecraft rather than the availability of the spacecraft. After survivability, the next priority is ensuring the ability of the ground to recover the mission when a fault is detected. There are many ways into and out of the satellite, some quite unconventional such as a laser uplink path. To ensure a recovery path, the system required to be designed against the normal rules, for example allowing a mechanism to reboot the spacecraft receivers. ESOC is in a unique position for this project, being the first time in control of the Space, ground and payload segment design simultaneously. Hence trade-offs between these three areas are more easily made than in more traditional missions. This paper describes the harmonious interaction between these three areas through the chosen solution of the FDIR system and its current status of implementation, ensuring the success of the mission.