1、Lessons Learned Entry: 0567Lesson Info:a71 Lesson Number: 0567a71 Lesson Date: 1998-04-09a71 Submitting Organization: JPLa71 Submitted by: C. Guernsey/D. OberhettingerSubject: Provide Software Checks On All Spacecraft Command Constraints (1997) Abstract: The Command and Control Subsystem for a comme
2、rcial satellite lacked software command constraint checks. A gyro sensitivity setting that was incompatible with on-orbit testing of the thrusters resulted in a severe spin. Recommendations involve allowable command parameters, walk-throughs of critical mission command sequences, and use of a system
3、 testbed facility.Description of Driving Event: As a commercial geosynchronous satellite achieved its approximate final orbit, on-orbit testing was initiated to check out the on-board electronics suite. In one test, ground controllers rolled the satellite slightly off of its normal attitude relative
4、 to Earth to check the attitude recovery loops. The proper response was for the satellite thrusters to automatically fire a short burst to roll it back. In this instance, however, the satellite responded by firing the thrusters and continuing to fire until the satellite went into a flat spin. The ce
5、ntripetal forces induced by a flat spin can cause structural damage.The cause of this incident has been attributed to the failure of ground controllers to change the gyro sensitivity settings prior to initiating the test. The satellite gyros have two sensitivity settingsfine (0.6 degrees/sec.) and c
6、oarse (5.0 degrees/sec.). The gyros had earlier been set to fine sensitivity for the transfer orbit, and ground control neglected to change them back to the coarse setting for this test. To check the attitude recovery loops, ground control commanded 1 degree/sec. of roll. This roll rate exceeded the
7、 sensitivity of the gyros, inducing saturation of the attitude control electronics (they could not recognize any level above 0.6 degrees/sec.) and resulted in a severe spin.Command and Control Subsystem designers did not incorporate software command constraint checks: such checks would have prevente
8、d thruster firing with an incompatible gyro sensitivity Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-setting. A contributing factor may have been human fatigue: multiple mission support was combined with this missions ambitious checkout schedule.A
9、dditional Keyword(s): Production-line SatellitesLesson(s) Learned: In keeping with “faster-better-cheaper“ and multiple-flight mission operations support, commercial satellite service providers may operate spacecraft without a detailed list of flight operations command constraint checks. Instead of
10、extensive ground simulation, the first of multiple crafts to be launched may serve as the flight test article.Recommendation(s): 1. Allowable command parameters should not permit exceeding spacecraft design capability.2. A walk-through of the design, implementation, and verification for critical mis
11、sion command sequences, with certification by appropriate cognizant engineers, should be a required procedure.3. Use of a system testbed facility to simulate all spaceflight operations is encouraged.Evidence of Recurrence Control Effectiveness: N/ADocuments Related to Lesson: N/AMission Directorate(
12、s): N/AAdditional Key Phrase(s): N/AAdditional Info: Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-Approval Info: a71 Approval Date: 1997-10-09a71 Approval Name: Carol Dumaina71 Approval Organization: 125-204a71 Approval Phone Number: 818-354-8242Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-
