ETTC'2003 - SEE

− The second level provides all design explanations and justifications to understand FCP
rationale. It aims at easily adapting FCPS to cover new anomaly cases.
2. Two execution phases are scheduled for anomaly FCPS : the first phase can be executed by
flight engineers without particular analysis. This phase consists in safe-hold operations. The
second phase usually aims at performing a satellite reconfiguration. Executing the second phase
requires a careful understanding of anomaly cause.
3. Formalised verifications are introduced : PIL language has been extended in order to provide a
more precise specification of the verifications to perform (using satellite telemetry) while
executing FCP. For instance, SPOT5 operational procedures include TM observation delays
(that was not the case in SPOT4 procedures) such as:
VERIFY “ULANOM = 0x8EOO AFTER 3s **Anomaly code for a payload temperature”
2.3 Advantages of a better formalisation of FCPs
Procedure formalisation enables automatic simulation, but it is not the only interest :
Procedures are better documented. Globally command/control knowledge is better traced and
formalised in operational procedures. TM effects specification is more complete, precise and
homogenous because of the writing rules which were introduced to enable automatic
verification.
1. Readability and usability is improved : it is particularly important to provide self-sufficient
procedures to operational teams because staff changes in ten or more operation years.
Conditions in control structures are more precise because formalised. For instance, rather than
writing informal condition “IF (“Pyrotechnic sub-system reconfigured”)…, TM parameter
USEFPYRO will be used to provide executable condition IF (USEFPYRO = REPLI) **
Pyrotechnic sub-system reconfigured.
2. Procedure use is more reliable : automatic validation will guarantee that specified TM effects
are correct in terms of TM mnemonics, expected values and evolutions (a given TM effect
should show different values before and after TC emission).
2.4 Flight Control Procedure types
We focus on reconfiguration procedures which are the most complex to define and validate.
Concerning reconfiguration procedures, four standard types have been identified :
1. Recovery to nominal configuration managed by on-board SW [LVC]: the purpose of this type
of procedure is to transfer an equipment or sub-system from redundant to nominal
configuration. It is generally used after an automatic reconfiguration performed by on-board
FDIR. There is embedded SW code to withdraw to redundant equipment. But the reverse
reconfiguration is never automatic (in the case of SPOT/HELIOS satellites) : there is no SW
function, directly available, to recover to nominal equipment. To perform such a
reconfiguration, FCPS are based on the following scheme : (1) modify on-board SW existing
FDIR code to inverse reconfiguration; (2) provoke an anomaly to reconfigure automatically
from redundant to nominal equipment (3) reload reference on-board SW.
2. Withdraw to redundant equipment managed by on-board SW: it is the simplest type of
procedure because the functionality is directly available on-board. The FCP consists in rising up
3