*5.1.5 Saturn approach phase*

*Loss of MAG data during SOI:* During the SOI event, no magnetometer data was acquired due to a sequencing error that caused an unexpected instrument reset (instrument FP was triggered). Since SOI was the only opportunity in the prime mission to fly very close to Saturn (until later in the extended mission phases), the loss of science data was considered to be very significant (**Figure 8**).

#### *5.1.6 Huygens probe mission*

*Probe Doppler bandwidth error:* Tests were conducted before reaching Saturn in February 2000 for the Probe ⇒ Cassini ⇒ DSN station data link delivery transmission. These analyses were needed to prepare for the Probe deploy and relay tasks, consisting of several flight exercises and performing "what-if" tests, as well as to validate the Probe's FSW. Since the Probe's two computers contained minimal

**Figure 8.** *Cassini-Huygens Saturn approach.*

onboard data storage capability, the data had to be transmitted to the Cassini orbiter directly during Titan entry, and then relayed to Earth. In this way, the spacecraft would provide the bulk of the data storage needed to support the Probe Relay task, throughout the descent and landing stages of the Probe mission. In the test, the Probe's signal was delivered to the Cassini spacecraft in flight, and then delivered to the DSN station on the ground. Results from this Probe ⇒ Cassini ⇒ DSN station relay test showed insufficient margin to maintain the carrier and subcarrier lock for the duration of the upcoming Probe mission. Analysis showed that the digital circuitry that decodes the data from the subcarrier did not have sufficient bandwidth to properly process the data from the subcarrier once it was Doppler shifted by the expected 5.6 km/s (nominal) velocity difference between Cassini and the Probe. The effect of this anomaly (caused by human error) would yield an unacceptable loss of data during the upcoming Probe Descent ⇒ Titan Landing phase since the digital circuit design did not adequately account for the Probe data's full Doppler shift.

*Fix:* In January 2001, a joint effort between ESA and NASA established the Huygens Recovery Task Force (HRTF) team to evaluate the problem and develop a solution. This effort leads to a three-part fix that allowed full recovery of the Titan data:

*Part 1:* The mission profile was redesigned to a Probe trajectory conducive to a low Doppler shift in the Probe-Cassini spacecraft radio link. The early part of the Saturn Tour was redesigned to a higher orbiter flyby altitude of Titan (at 60,000 km). This required that the (original) first two orbital revolutions around Saturn be increased to three revolutions (the tour configuration was unchanged after this point; this extra orbit was at a moderate ΔV cost).

*Part 2:* Preheating of the Probe's transmitters was necessary before its descent into Titan's atmosphere so that the transmit frequency could be optimized.

*Part 3:* The new mission design would now have a much lower Doppler shift than that of the original Probe mission. This would require that the Probe be commanded to its "Base Frequency" (referred to as "BITE Mode," a "zero Doppler" test mode that held the lockup frequency at a level equivalent to −1 m/s relative velocity). This BITE Mode of operation must be maintained constantly, even in the presence of fault occurrences and Safe Mode activations. To accomplish this goal, an empty slot within the ATC FSW (eight ATC monitors were in use; four empty placeholders were designed into FSW for

**143**

was called.

*Robotic Autonomous Spacecraft Missions: Cassini Mission-To-Saturn Example*

future use) was programed to send the "Probe BITE Mode" command continuously, since these ATC algorithms are capable of issuing commands every

*Safe mode activation #5:* In S33, very soon after a flyby of the Iapetus moon was completed, a SSPS Trip occurred on the prime TWTA. The spacecraft interpreted the SSPS trip as a hardware failure and executed the Safe Mode three times and swapped to the redundant backup TWTA unit. The FP also commanded a TCU

*Fix:* The prime TWTA was powered back on (and swapped back), and FSW was updated to implement new FP for selected devices in order to avoid activating SSPS Trip FP. This FSW fix was planned in advance of this incident, based upon observed SSPS trips, but was not uplinked in time to preclude this TWTA SSPS trip. Exactly 1 year later, another SSPS trip occurred on the prime TWTA unit. FP was not acti-

*Loss of MIMI motor drive:* In January 2005, a motor controlling one of MIMI's three detectors suffered a mechanical failure. Although all three detectors were still fully functional, one was forced to rely on spacecraft pointing for proper orienta-

*Loss of SSR DRAM memory:* In December 2006, a portion of memory failed within one of the SSR's DRAM memory units, in a location where science/engineering data is stored. This failure was significant because the memory was corrupted, leading to ground software decomposition problems as well as erroneous science and engineering data. No capability to remove or bypass bad areas of SSR hardware memory had

*Fix:* New capability to bypass corrupted memory locations was uploaded to FSW.

*RCS thrust branch swap:* In March 2009, Cassini swapped over to the backup branch of RCS thrusters to replace those that had been in use since launch, since the prime thrusters were exhibiting increased chamber pressure roughness and decreased thrust (e.g., these thrusters were displaying end-of-life characteristics). *Loss of an ATC temperature sensor:* Temperature readings are reported to each ATC from two sensors. For ATC #7, these sensors are mounted on opposite sides of the ME, and are used to monitor chamber temperatures. In 2009, during a maneuver, one of these sensors began to report erroneous data. It was speculated that the

*Fix:* The SOFS team uplinked a command to declare the sensor "dead" (not usable), since the ATC was able to function with only the single remaining sensor. Also, a new operations strategy was developed to eliminate the use of ATC #7

*Safe mode activation #6:* On November 2, 2010, during the S64 background sequence, a file was uplinked to reset the backup AFC computer during normal operations. The command was hit by a cosmic ray and corrupted (bit flip), causing the prime CDS computer to reset from receipt of this erroneous command (caused by a failure of the uplinked command to process properly). As a result, Safe Mode

*DOI: http://dx.doi.org/10.5772/intechopen.82161*

*5.1.7 Tour operations*

swap and an RFS POR.

vated due to the new updates.

been implemented into FSW.

(implemented in S56).

12 s, even during and after FP activations.

tion. The loss to MIMI science was approximately 10%.

**5.2 Extended mission experience (equinox mission)**

failure was most likely caused by a soft short.

**5.3 Second extended mission experience (solstice mission)**

future use) was programed to send the "Probe BITE Mode" command continuously, since these ATC algorithms are capable of issuing commands every 12 s, even during and after FP activations.
