GP-B Post-Flight Analysis—Final Report - Gravity Probe B - Stanford ...

configured on-orbit as required. If a test fails then a failure counter is incremented, otherwise the failure counteris set to 0. if the failure counter exceeds a limit (also configurable on-orbit) then a configurable set of predefinedand preloaded safemode macros are activated. Breaking it down we get:• There are 98 tests across the C&DH, ATC, Payload, EPS, and Thermal subsystems. Each test can beenabled or disabled by real-time or stored commands. The test failure limits and the consecutive failurelimit for each test can be altered by real-time or stored commands. The safemode macros to activatewhen the test exceeds its consecutive failure limit are also configurable via real-time or storedcommands.• There are 47 safemode macros that do everything from switching to the backup computer to doingnothing (allows notification of the hardware failure status to be quickly noticed but leaves the responseto the GPB staff).• Once a test has been activated it will not activate again until re-enabled preventing an “infinite loop” ofsafemode responses. Further, once a safemode macro has been activated it won’t activate again until reenabled.Figure 8-36 illustrates the structure of a safemode test.Figure 8-36. Structure of a Safemode TestFigure 8-37 is an excerpt from a table made during March 2005 while the Safemode configuration was beingevaluated. Note that some tests are disabled, primarily the secondary tests that would get enabled when theprimary test failed.Figure 8-37. Excerpt from Safemode Status in March 2005Gravity Probe B — Post Flight Analysis • Final Report March 2007 247