Communication "Tones" and Their Use as Reliability Assessment Tools in High Risk Aerospace Maneuvers

Abstract

he success of the Mars Exploratory Rovers, Spirit and Opportunity, has pleased many in the scientific community. The findings concerning the past and present Mars environment and geology continue to impress scientists of many professional backgrounds. For engineers however, the success of these two spacecraft is more related to the fact that they were able to survive all the perils in these missions. It also confirms the need for a lot of hard work, such as establishing reliability assessment tools that allow us to measure, quantitatively and qualitatively, the health of the spacecraft. One such assessment tool is the design and development of hardware and software functionalities, within the spacecraft telecommunication subsystem, which will transmit “tones” upon the successful completion of each of the many high-risk maneuvers in the last ten minutes of the flight (descent and landing). It is known from past experience, that most U.S. missions to Mars have failed in the last ten minutes of the flight. This timeframe is known as the “ten minutes of terror,” and accounts for all the descent and landing maneuvers the spacecraft needs to make for a successful landing. A single failure in any of these maneuvers (more than 20 which are fully automated) would be catastrophic. In 1999 the Mars Polar Lander, a three-legged spacecraft, rather than a rover, failed in its attempt to land on Mars’ south pole. The mission was going well until the last ten minutes —the start of the descent and landing phase of the mission. In the last ten minutes of the flight, the spacecraft rotates into its attitude for entry into the Mars atmosphere. The fiery descent is the start of the ten minutes of terror. We never knew for certain what maneuver failed during the descent and landing of the Mars Polar Lander. A later failure investigation determined that a software error cut off the descent engines prematurely during the last maneuver and caused the spacecraft to crash land during the last 500 m. However, it is also possible that the failure occurred earlier, but we will never know. From an engineering point of view it is necessary to understand the failure mechanisms during these critical mission events in order to improve the reliability of subsequent spacecraft. Therefore, it is important to know when a failure occurs (i.e. which critical maneuver and at what time), and how did it occur. During the last ten minutes there is no spacecraft telemetry, the spacecraft transponder is switched to a carrier-only mode. Sometimes major events can be detected during the descent through a Doppler shift in the carrier frequency (e.g. during the descent the spacecraft velocity is reduced from 30,000+ miles/hour to about 7000 miles/hour). However, many small events will go undetected. Any failure in these small events could be catastrophic. How can we assure ourselves that a particular event, small or large, was completed successfully? Or from a failure analysis point of view, if a failure occurred, in a particular maneuver, can we associate that maneuver with a given event in the descent and landing timeline? If so, we will know with some confidence the hardware or software responsible for a given failure and how to improve its reliability the next time around. (Notice that Spirit and Opportunity spacecraft were launched within 24 days of each other). The spacecraft deep space transponders were designed to accommodate the additional feature of a tone mode. The X-band transponder will transmit a tone every time a successful event is accomplished. The very weak tones will be captured by the very large diameter dish antennas of the deep space network, located in New Mexico, Spain, and Australia. The failure to transmit or receive a tone will indicate that the particular maneuver or event may have failed. Fault management software is synchronized with the flight software such that failures, or lack of failures, detected by fault management software will translate into executable commands by the flight software to activate the tone mode feature in the X-band deep space transponder. A hardware interface was developed in the deep space transponder to accommodate this particular type of command from the flight software.