Simulation Framework for Architecting Autonomous Fault Protection

The preliminary spacecraft design process requires systems engineers to consider many disparate spacecraft subsystems both in isolation and in the context of their effect on other subsystems and overall mission goals. In current spacecraft system engineering methodologies, one topic that is often neglected in the early stage process is autonomous fault protection. This is because the effects of different approaches to fault protection on various subsystems are difficult to distil until fault protection software is implemented and tested — on, for instance, a hardware testbed. This implementation does not usually happen until after the majority of subsystem designs have been fixed, and therefore the design of an autonomous fault protection scheme can be hampered by technical debt. To address this issue, we present a software framework that can be used to evaluate different fault protection approaches in a preliminary system design context. This framework consists of a general purpose system simulation package that supports fault injection at a high level of abstraction. Using this package, we implement a low fidelity, six-degree-of-freedom simulation of a spacecraft which focuses on outputting system-level spacecraft performance metrics relevant to fault protection. We run this simulation on a scenario inspired by the failure of the Mars Global Surveyor mission to demonstrate how our framework can be used to quantify the effects of fault protection on the system early in the design process.