**4.6 Meeting challenging problems through FP & FSW uploads**

To aid in many of the above challenges, onboard autonomous Fault Protection routines are implemented into the computers' FSW to monitor the spacecraft's many systems and devices to autonomously detect fault occurrences and respond to anomalous conditions. FP consists of "canned" automated responses that can swap to redundant devices (if available), command actions (like closing valves, commanding alternate targets, etc.) and/or place the spacecraft into a "safe state" using preprogrammed instructional routines. A general-purpose, "Safe Mode" fault response routine is typically executed if the fault condition interferes with the onboard running sequence (along with other corrective actions performed by FP if required), which terminates the onboard running sequence, configures the spacecraft to a lower power state by powering off all nonessential spacecraft loads, commands a thermally safe attitude and safe state for the hardware, establishes a low uplink and downlink rate for earth communications, and commands the LGA antenna (to accommodate the low rates). This safe, predictable spacecraft state allows the SOFS sufficient time to evaluate the fault causes and determine a solution [6]. On Cassini, FP was implemented early in the design phase. In general, FP responsibility is allocated to both the SOFS team and the spacecraft (which must deliver sufficient information on its health and fault condition to support fault recovery).

Unexpected conditions and problems can potentially exist for spacecraft missions that are exploring unknown parts of our solar system. New devices never flown in space before can experience unexpected faults due to the adverse flight environment. For these reasons (and those stated above), designers provide the SOFS team with the ability to upload FSW patches (replacing the memory locations within the onboard FSW with new data), and to replace entire CDS, AACS, or instrument FSW loads so that unknown problems can be addressed and increased visibility added to the downlinked telemetry stream.
