ETTC'2003 - SEE

a satellite anomaly from ground. On-board FDIR will automatically perform the
reconfiguration. This type of procedure is used to run in a redundant equipment (such as earth
sensors) or to anticipate nominal equipment failure.
3. Reconfiguration to redundant equipment managed by ground: no reconfiguration mechanism is
implemented on-board. The model of such FCP is the following : (1) replace commands sent
by the on-board SW to nominal equipment by commands sent to redundant one. It is done
through on-board SW patches (as far as SPOT/HELIOS satellites are concerned). (2) configure
monitoring to redundant parameters instead of to nominal ones ; and vice versa. This is done
also by patch.
4. Reconfiguration to nominal equipment managed by ground: same principle as procedures of
type 3. But this type of FCP is usually not defined in Flight Control Manuals because its use is
rare.
3. Test case definition
A test-case model for FCPS of type 1 (recovery managed by on-board SW) is introduced. To
validate such FCPS the steps are the following :
1. Satellite initial context is a routine one with an operational payload; this context results from a
previous simulation and is restored to start the scenario.
2. Withdraw FCP is first executed to reconfigure to redundant equipment; this is the initial state of
the recovery FCP, which is the procedure to validate. This procedure includes all the required
telemetry verifications to check that the redundant configuration is correctly reached.
3. Recovery FCP is run to return to nominal configuration and verifications are performed.
4. Programming message execution (MdP) comes afterwards: this step is important because it
consists in testing the capacity of running programming messages on redundant equipment.
Furthermore, some devices require MdP execution to be switched on. The same MdP is used
for all test-cases. It was constructed to be as complete as possible in the terms of payload use.
5. Withdraw FCP is executed to finalise the test-case: the objective is ensure that on-board FDIR
is still capable to withdraw to redundant configuration when an anomaly occurs. This
verification is necessary because of the use of patches within “withdraw FCP”.
Notice that “recovery FCP” validation requires to define and validate corresponding “withdraw
FCP”, even if the latter is less important because less likely to be used operationally.
4. Testing facilities
Two satellite operation simulators were used during the compatibility, Technical (QT) and
Operational Qualification (QO) phases for satellite SPOT5.
The first simulator, the BSSO (Banc Système Satellite Opérationnel – Operational Satellite
System Test-bench), is a hybrid test-bench, i.e. composed of hardware and software elements,
developed by the satellite prime contractor (ASTRIUM). The main characteristic of this simulator is
the presence of real hardware (mock-ups) for all equipment containing software (OBC, etc.).
The second simulator, SINUS (Simulateur Numérique Satellite – satellite digital simulator), is a
purely digital simulator developed by CNES as internal prime contractor. Its main characteristic is
the presence of an MA31750 processor emulator which allows it to operate faster than real-time.
4