[amsat-bb] Good questions

["Stacey E. Mills" <w4sm@xxxxxxxxx>]

A few interesting topics have been raised recently.

>I would think the correct design would be to automatically disconnect all
>batteries in an extreme low voltage situation. The satellite could then be
>run on solar while the batteries are charged via high resistance path and
>then connected to the buss if they charge. If a bad set is connected they
>will be automatically dropped and another set can be connected if available.
>We know the eventually every satellite will be running on solar alone,
>without batteries. We need to design for this at the beginning.
>
>If this has already been suggested please excuse my oversight.
>
>Don
>kd6ir

I wasn't involved at the time this decision was made for AO-40, but I 
believe that Lou McFadin indicated in an earlier posting that this option 
was considered.  I'm sure the reasons not to do it were good ones, and 
involved weighing the likelihood of all the possible failure scenarios.  Of 
course, with the power of retrospection, this mode might have saved us from 
AO-40's recent failure mode, but that doesn't mean the decision was the 
wrong one at the time.  I don't know if the BCR's have enough inherent 
capacitance to maintain an adequately uniform voltage to sustain the IHU, 
receivers, and one transmitter with no batteries connected.  There's also 
the issue of disconnecting the batteries during an eclipse, precisely the 
time when power is likely to be low, which would lead to an instant IHU 
crash.  ...not the end of the world but not something to be taken lightly, 
especially if we were in 3-axis mode with the momentum wheels 
running.  Cutting the power to them in run mode, would be fatal, as the 
supporting magnetic field would collapse and the spinning wheels would 
crash into the surrounding structure.

However, your point that all satellites eventually have failed batteries is 
a good one, and I'll come back to it below.


>If certain conditions are met (or are NOT met) the bird could automatically
>enter a pre-defined default mode. For example,  if no communication is made
>to the satellite in X amount of time, or battery voltage gets extremely low,
>etc the bird resets itself, or something to that effect.
>
>Is it possible to create such a system in future satellites?
>
>73,
>
>Kyle Yoksh

Virtually all satellites have HIGH LEVEL functions to deal with these 
issues, meaning that they require a functional IHU for implementation.  For 
example, AO-40 has a watchdog timer which cycles through a series of 
antenna, receiver, and transmitter, configurations if a command is not 
received within a set number of orbits.  Likewise, AO-40 has trigger values 
to shut off transmitters, experiments, magnetorquing, etc. if temperatures, 
voltages or solar angles surpass set trigger points.

The more interesting issue is if the IHU should have a way to reset and 
reload itself.  In the past this has not been necessary on Phase 3 
satellites because 1. reloading IPS software takes very little time and can 
be accomplished under very adverse conditions, and 2. IPS is an amazingly 
robust language.  Setting aside software crashes related to hardware 
failures as in the 400 N incident and the most recent battery incident, IPS 
on AO-40 has run failure free for three years.  AO-13's IHU had a similar 
outstanding track record.

Amsat has followed the time-proven rule of making mission critical items 
only as complicated as they need to be and no more so.  It doesn't take 
much imagination to see how a software reset device, designed improperly, 
could also cause extreme, mission ending problems if it failed.  Having 
said the above, however, the P5 mission will not have the luxury of easy 
reloads and will need its IHU to be functional for DSP-type command 
decoding under adverse, low data rate conditions.  Therefore, a 
hardware-only reset may not be possible.  Planning for this mission has led 
to a rethinking of how to deal with this issue.  This is discussed in some 
detail in the P3E update in this month's Amsat journal.  Briefly, Karl 
Meinzer and colleagues have designed a system that will allow the IHU to 
reset itself and reload flight software from one of two flash memories.  If 
one memory fails, the other software copy is used.  Appropriate safeguards 
are included to prevent the system from "locking up" or preventing 
ground-based resets.  Similar systems appear to be in operation on "Spirit" 
and "Opportunity".

Given the above, it would be interesting to contemplate a P3-E or 
Eagle-type spacecraft incorporating an end of life, "no-battery" mode, 
along with the self-reset function above.  In the event of battery 
failure(s), assuming the BCR's could function in this mode (enough 
capacitance), the batteries would be taken off line.  One could have an IHU 
which "woke up" after every solar eclipse, reloaded it's flight software 
and took off running...



-- 
  ________________________________________________________________________
  Stacey E. Mills, W4SM    WWW:  http://www.keplerian.com
    Charlottesville, VA     PGP key: http://www.keplerian.com/key
  ________________________________________________________________________  

----
Sent via amsat-bb@amsat.org. Opinions expressed are those of the author.
Not an AMSAT member? Join now to support the amateur satellite program!
To unsubscribe, send "unsubscribe amsat-bb" to Majordomo@amsat.org