Graceful Degradation of Spacecraft Capabilities with Simulated Component Failure

Development of fault detection, identification, and recovery systems for space missions requires engineers to consider interactions among all spacecraft subsystems. These systems must be robust and rigorously tested so as to not cause harm to the spacecraft. Combined with the complexity of the interactions that must be considered, this leads to conservative approaches even in modern spacecraft where the system includes redundant components, yet the response to most faults is to transition to safe mode and wait for intervention from the ground. However, a single fault may not disable a spacecraft to an extent which precludes continued operation, especially in spacecraft with redundant components. In this case, transitioning to safe mode and waiting for human intervention leads to mission downtime which impacts spacecraft performance and could be avoided. In this work, we prototype a new framework for fault detection, identification, and recovery that introduces graceful degradation of spacecraft capability in the presence of component failure. To demonstrate our framework, we focus on the attitude control subsystem. We simulate using the syssim library, a software package that enables the modular modeling of arbitrary dynamical systems with a robust and expressive API for defining faults to be injected at runtime. The MONSID library — a model-based health assessment software based on the technique of constraint suspension developed by Okean Solutions — is used in the loop for fault detection and diagnosis. We evaluate the performance of this ensemble on a non-trivial cascading fault in a set of sensors associated with an attitude control system. Graceful degradation is demonstrated across groups of redundant components that allow the spacecraft to continue operation even when a single component, such as a reaction wheel or gyroscope, has failed.