An autonomous control system supports autonomous operation of the a spacecraft in carrying out mission objective commands. The control system also provides autonomous fault detection, isolation and recovery. Performance problems and anomalies are detected and accounted for in the carrying out mission objectives. A mission manager module analyzes all incoming mission objective commands to verify that sufficient system resources are available and not already dedicated to other pending mission objective commands. A command processor is included to translate acceptable mission objective commands into lower level command sequences for delivery to a flight manager controlling the underlying spacecraft systems. The mission manager reanalyzes all pending mission objective commands whenever unexpected performance or fault conditions are detected. The mission objective commands can be constructed in a hierarchical fashion, with many sequences predefined within the spacecraft. All portions of the autonomous control system, including software and associated data, can be readily replaced, supplemented or disabled at any time before, during or after launch.

Method and system for autonomous spacecraft control

A fault identification, isolation and fault recovery system autonomously controls spacecraft operational systems. A fault detection and isolation module monitors the operational systems, identifies faults via such monitoring and attempts to isolate component causing the fault. Isolation may constitute a plurality of hierarchically arranged techniques that enhance speed and maximize the likelihood of identifying a correct hypothesis regarding the actual failure. The fault isolation and fault recovery modules are bounded by a severe fault override module which places the spacecraft operational systems in a safe mode or state. Thus, the override module ensures rapid entry into the safe mode while preventing an erroneous hypothesis serviced by the fault recovery module from driving the system beyond acceptable limits. A high level command processor receives command sequences from remote ground support stations and from the on-board fault recovery module. A ground based test bed attached to a ground support systems is used to generate verified high level fault recovery scripts before and during a mission to bolster fault recovery capabilities.

In situ method and system for autonomous fault detection, isolation and recovery

This paper presents a model-based fault management (FM) system designed to provide off-nominal state detection and isolation capabilities that are key components to assessing spacecraft state awareness. The ability to autonomously isolate spacecraft failures to component levels will enable faster and more targeted responses and recovery thereby reducing down time. The use of model-based systems and practices is being explored by the FM community as a viable approach to developing more capable, autonomous systems in order to meet mission objectives. Model-based systems can provide better fault identification than traditional methods of fault detection such as limit-checking. They also lend themselves to more straight-forward approaches to verification and validation. We have chosen a particular model-based technique called Constraint Suspension for autonomous fault detection and isolation that does not require explicit fault modeling. The system is composed of a diagnostic engine and nominal system models of the target application, for example sensors and actuators. Sensed data are propagated through models of nominal system behavior. Faults are diagnosed when inconsistencies arise between sensed and modeled data. Several benefits result from this choice. First, because knowledge of faulty behavior is not required, it is possible to detect unanticipated and unforeseen faults. In fact, anomalous, degraded, and failed states all can be detected. Second, the same models used for nominal analyses and operations can be re-used for fault management, saving development resources and time. Third, the core diagnostic engine algorithm is complete and requires no additions to accommodate a potentially growing number of faults over time resulting in a relatively compact software footprint. Related to the second and third points is that the core algorithm and, potentially, models can be reused from mission to mission. Finally, the system can be used early in the design phase as a tool for sensor placement analyses and model verification. Health information produced by the FM system can be used to make resource allocation and planning and scheduling decisions by ground operations or by other on-board autonomy agents. Autonomous fault detection, isolation, and recovery (FDIR) on board space vehicles will provide protection and increased mission availability and reliability. On the ground such systems enable lights-out monitoring as well as training and support for operators. This paper presents the development of fault detection and isolation algorithms and models. Application of the system to a spacecraft attitude control system is discussed. Finally we apply Model-Based Systems Engineering (MBSE) modeling patterns to the fault management system models as a way to facilitate the development of the models through the use of SysML.

Model-based off-nominal state isolation and detection system for autonomous fault management

Automated control of a large electrical power distribution network through a single controller can provide advantages in efficiency and reliability as well as reduction in maintenance costs. For control to be most effective, it is necessary that a global view of the entire network be had by the controller, so that it can reason as to the cause of the readings of the various sensing devices located throughout the network, Traditional approaches to power system control have involved a set of local devices (i.e., protective relays) that base their decision on the instantaneous reading of a single sensor. These single-parameter decisions can sometimes be incorrect due to sensor failures. Furthermore, a special type of fault called a soft fault, where a fault impedance limits the current to a value below the relay operating point, are nearly impossible to detect with decisions based on a single local parameter. By reasoning over an entire suit of sensing devices spread throughout the entire network, protection decisions based on a global view can become more reliable as well as comprehensive. Some previous approaches have implemented global control with varying degrees of success through the use of rule-based knowledge-based systems. This paper describes an alternative knowledge-based approach that makes use of so-called models of structure-and-behavior, to which model-based diagnosis is applied. The objective of this approach is to develop a system that can reliably diagnose faults in power distribution networks (especially soft faults), identify sensor failures, and carry out appropriate corrective action automatically. An intelligent power controller (IPC) which has these capabilities is described. This IPC was rigorously tested in an DC electrical power distribution system testbed and found to successfully carry out the required functions. This paper also describes in detail the tests and the conclusions drawn from their results.

Model-based, real-time control of electrical power systems

This paper discusses the development of a theory of anomaly management that uses fundamental models of a system's structure, behavior, and intended use to support the detection of symptoms, the computation of possible diagnoses, and the generation of resolution actions. A software-based reasoning system based on this theory was implemented and applied to the configuration control of a space system consisting of an on-orbit satellite and a geographically distributed network of ground communication and control stations. This system was found to promote a formal and systematic analysis of possibilities when managing configuration anomalies in the Sapphire space system. This approach can be extended to more complex systems through future optimization of the processing implementation and through incorporation of other innovations such as dynamic and hierarchical modelling

Managing space system anomalies using first principles reasoning

Modeling power systems for diagnosis - How good is good enough?

An innovative approach to fault management was recently demonstrated for the NASA LeRC Space Station Freedom (SSF) power system testbed. This project capitalized on research in model-based reasoning, which uses knowledge of a system's behavior to monitor its health. The fault management system (FMS) can isolate failures online, or in a post analysis mode, and requires no knowledge of failure symptoms to perform its diagnostics. An in-house tool called MARPLE was used to develop and run the FMS. MARPLE's capabilities are similar to those available from commercial expert system shells, although MARPLE is designed to build model-based as opposed to rule-based systems. These capabilities include functions for capturing behavioral knowledge, a reasoning engine that implements a model-based technique known as constraint suspension, and a tool for quickly generating new user interfaces. The prototype produced by applying MARPLE to SSF not only demonstrated that model-based reasoning is a valuable diagnostic approach, but it also suggested several new applications of MARPLE, including an integration and testing aid, and a complement to state estimation.

Model-based diagnostics for Space Station Freedom

An expert system (ES) has been developed to perform spacecraft fault management autonomously, allowing the spacecraft to remain operational over an extended period. The system uses model-based reasoning and operates in a closed loop with a simulated spacecraft. The ES interacts with the spacecraft, performing fault management functions on power subsystem components using a technique known as constraint suspension. This technique isolates failures by reasoning from the structure and behavior of the system without knowledge of how these failures manifest themselves. >

On-board fault management using modeling techniques

Recently, a knowledge-based approach was used to develop a system called the Command Constraint Checker (CCC) for TRW. CCC was created to automate the process of verifying spacecraft command sequences. To check command files by hand for timing and sequencing errors is a time-consuming and error-prone task. Conventional software solutions were rejected when it was estimated that it would require 36 man-months to build an automated tool to check constraints by conventional methods. Using rule-based representation to model the various timing and sequencing constraints of the spacecraft, CCC was developed and tested in only three months. By applying artificial intelligence techniques, CCC designers were able to demonstrate the viability of AI as a tool to transform difficult problems into easily managed tasks. The design considerations used in developing CCC are discussed and the potential impact of this system on future satellite programs is examined.

Amy Stephan

Papers

Modeling power systems for diagnosis - How good is good enough?

Model-based diagnostics for Space Station Freedom

On-board fault management using modeling techniques

Spacecraft command verification: The AI solution