Fault protection design of the quikscat and seawinds instruments

The QuikScat and SeaWinds instruments are radar scatterometer instruments that will be used to measure ocean surface winds. The QuikScat instrument will be launched on dedicated spacecraft in November 1998, and the SeaWinds instrument will be launched on the Japanese ADEOS-II spacecraft in the summer of 2000. The instrument is designed to continuously operate in a wind observation mode for nearly the entire three year mission. However, a number of fault and external conditions can occur that will interrupt the instrument's continuous wind observations. These types of faults include the failures in the radar unit's TWTA, communication errors with the spacecraft, communication errors between the instrument's three subsystems, software errors in the computer subsystem, and possible effects of cosmic ray or solar induced single event upsets in the instrument's computers. In general, the philosophy of the instrument's autonomous fault response is to perform different levels of resets in order to clear a fault that is causing a particular type of problem. In general, the instrument attempts to recover from the fault in a manner that will allow the instrument to resume normal operations without ground intervention. However, if the fault does not clear with a reasonable level of effort by the autonomous algorithms in the instrument, the instrument places itself into a safe standby mode and waits for ground interaction. In no case does the instrument attempt to recover from faults by switching redundant units. The switching of redundant units is to only be performed under command and control from the ground. This paper describes the fault protection mechanisms that have been designed into the spacecraft, in order to react to certain faults and failures in the instrument. In addition, it explains how these mechanisms escalate their response when a fault is not cleared by their initial response. Also, this write-up describes the actions that the spacecraft will take on behalf of the instrument in the case of a spacecraft failure that will require the shutdown of the instrument.