*5.1.4 Science cruise phase*

*Aerospace Engineering*

parameter was updated.

SOFS team determined that only flight experience can reveal this problem and the

During the mission, 38 trip events occurred, some of which had significant effects. In May 2005, the USO experienced a trip event, causing loss of communication with the SOFS team until two-way communication could be established once again. In September 2007, the Traveling Wave Tube Amplifier (TWTA) underwent a trip event, causing FP to activate; Safe Mode was executed three times, in addition to a Power-On-Reset (POR) of the RFS system and a Hardware (HW) swap of the TCU and TWTA. The spacecraft's DST was hit in September 2013, causing the Command Demodulation Unit (CDU) to reduce the uplink transmission rate from

*Fix:* Nothing can be done to prevent SSPS trip occurrences. Therefore, a new "SSPS Trip" FP algorithm was designed and uplinked into the spacecraft's FSW to address these SEU induced trip events. This new FP monitors each SSPS switch and responds to trips conditions with a predetermined response which is unique for

*Degradation in the ME cover:* Shortly before the DSM maneuver, when the ME cover was opened, the cover did not deploy as far as it had in ground tests (14° less than expected), although the opening angle was sufficient to allow for ME burns. The cause was attributed to an increased stiffness in the cover material due to its exposure within the radiation environment of the inner solar system, and to a lesser extent, the long period of disuse. Unfortunately, the ME cover activity within flight environment could not be adequately tested on the ground prelaunch. Since the DSM maneuver, the ME cover opening angle held steady through many cycles, with no further signs of degradation observed. The cover behavior was monitored by the

*Safe mode activation #3:* In 2001, the backup CDS computer experienced a reset due to an oversite in the onboard sequence (human error); a missing telemetry mode definition. As part of the CDS design, all telemetry modes (the rate at which data is downlinked) are executed in both the prime and online CDS computers. As a result of an SOFS exercise to update the SSR with MAG replacement heater patches, one of the backup CDS computer's telemetry modes were overwritten (and thus, was not available), so that it existed only in the prime CDS computer. After activating this particular telemetry mode from the C26 background sequence, the backup

*Fix:* The SOFS team uses "flight rules" and constraint checklists to ensure errors do not creep into sequences; this particular check was not included in the real-time

*RWA increased friction anomaly:* On December 16, 2000, RWA wheel #2 caused the spacecraft to autonomously switch from RWA control to RCS control due to

switch trips, and if it is operating at the time of the event.

500 bits-per-second (bps) to 7.8 bps.

SOFS team until the End of the Mission (EOM).

CDS reset since the telemetry mode did not exist.

patch checklist, and was henceforth added to this list.

each of the 192 SSPS switches.

*5.1.3 Outer cruise*

*Spurious SSPS trip events:* Starting at L + 4 months on February 14, 1998, Cassini started to experience trip-off events on its 192 SSPS switches, with an average of two trips per year. Cassini was the first spacecraft ever to use SSPS switches, so that the effect of the flight environment on these devices was not completely predictable. These trips are caused by galactic rays within the flight environment, where one or more photon hits on the voltage comparator of the switch, and can result in a false indication that the current load is anomalously high. This causes the switch to transition from either an "on" or "off" state to a "tripped" condition, which can result in either a benign or serious effect on the spacecraft, depending on which

**140**

*Safe mode activation #4:* The C37 cruise sequence was operating nominally when one of the target vectors was queued to be loaded by the series of commands in operation. Although this target vector was provided in the AACS table being accessed, the associated time-tag associated with the command contained an error, so that it was labeled prior to the start time of the C37 sequence. Since the vector could not be loaded properly, the Safe Mode response was requested.

*Fix:* The proper vector was reloaded and the sequence restarted onboard the spacecraft; ground procedures were updated to preclude this human error from happening again.

*Activation of the redundant RWA #4 wheel:* All three RWAs had started to exhibited the same high friction levels at low RPM (drag torque spikes), but unlike RWA #1 and RWA #2, RWA #3 also began to exhibit "cage instability," which is characterized by vibration of the metal cage that holds the ball bearings in place. Analysis showed that the wheel was trending towards possible failure in weeks to possibly months.

*Fix:* RWA #3 was commanded off to save its remaining life and the redundant (spare) RWA #4 was turned on to replace it.
