# Presentation: 590353

## Failure Review Board

***Final Presentation*****April 21, 2006**

**IMAGE FRB Website:  https://secureworkgroups.grc.nasa.gov**

## AGENDA

**Charter and Team Members****	****	****	*****Mike Prior***
**Overview of IMAGE Mission & Spacecraft****	*****Rick Burley***
**Summary of Lost Contact****	****	****	*****Rick Burley***
**Anomaly History****	****	****	****	*****Rick Burley***
**Fault Analysis Introduction****	****	****	*****Mike Prior***
**Fault Analysis Cases****	****	****	*****Mike Prior***
***	******	******	******	******	******	******	******Scott Hull***
**	****	****	****	****	****	****	*****Mike Powers***
**	****	****	****	****	****	****	*****Amri Pellerano***
**Recovery Possibilities****	****	****	*****Mark Tapley***
**Post Recovery Operations****	****	****	*****Rick Burley***
**Lessons Learned****	****	****	****	*****Jim La***
**Conclusion****	****	****	****	****	*****Mike Prior***

## Board Membership

***Consultants***

***Main Board***

## Charter

**Review previous IMAGE spacecraft anomalies and history to identify possible relevance to the failure event.**** **
**Assess the spacecraft operation prior to and during the event.  Review spacecraft engineering data trends leading up to the event.**** **
**Review the adequacy of the recovery operations used in response to the event.  Identify any additional procedures or tests that should be executed.**** **
**Perform a fault tree analysis and identify the likely cause(s) of the failure.  Identify possible impacts to other missions that may be susceptible to similar failures.**** **
**Identify the documentation and data that should be captured to closeout the IMAGE operation.**** **

## IMAGE PRIMER

**IMAGE PRIMER**

**Rick Burley, IMAGE Mission Director**

## Science Objectives

**What are the dominant mechanisms for injecting plasma into the magnetosphere on substorm and magnetostorm timescales?**
**What is the directly driven response of the magnetosphere to changes in the solar wind?**
**How and where are magnetospheric plasmas energized, transported, and lost?**

## MIDEX #1, PI Dr. James Burch, SwRI

**FUV - Far Ultra-Violet imager,  Steven Mende, UCal/Berkeley**
**EUV - Extreme Ultra-Violet imager, Bill Sandel, University of Arizona**
**RPI - Radio Plasma Imager, Dr. Bodo Reinisch, UMass/Lowell.**
**HENA - High Energy Neutral Atom imager, Don Mitchell, APL**
**MENA - Medium Energy Neutral Atom imager, Craig Pollock, SwRI**
**LENA - Low Energy Neutral Atom imager, Tom Moore, GSFC**
**CIDP - Central Instrument Data Processor, SwRI**
**SMOC - Science and Mission Operations Center, GSFC**
**DSN - Deep Space Network, JPL**

## LMMS Spacecraft Bus

**LMMS Spacecraft Bus**

**Size: 496Kg, 1.52m x 2.25m**
**Aluminum honeycomb side panels (8), forward and aft panels, payload deck, and interior shear walls; two central load-bearing aluminum cylinders (forward and aft).**
**Heat pipes in payload deck connected to radiators on spacecraft side panels; MLI blankets; thermostat and CIDP/PDU-controlled electrical resistance heaters for payload and spacecraft operations and survival.**
**RAD6000 SCU, 4Gbit DRAM MMM**
**S-band MGA, 2 LGAs, 44Kbps & 2.29Mbps downlink, 2Kbps uplink.**
**Attitude Control: Spin-stabilized; closed-loop spin-rate control.  Sun sensor, Star Tracker, Three-axis Magnetometer, Torque Rod.**** **
**Direct energy transfer; microprocessor-controlled power distribution unit (PDU) performs power distribution and battery charge control functions; Mil-Std-1553B interface with SCU.**
**Body-mounted dual-junction gallium-arsenide solar cell arrays and 21 amp-hour Super NiCd battery; operating range: 22-34 Vdc**

**IMAGE designed as single string with only limited redundancy.**

## Mission Operations Concepts

**There are no scheduling conflicts among the instruments.  There is sufficient power, thermal, data margin that any instrument can be in any mode without conflicts.**
**Primary instrument scheduling activity is voltage reductions for predicted radiation belt passage.  1 science ‘load’ per week.**
**Onboard attitude determination.  No orbit maneuvers required.  No propulsion system.**
**IMAGE was made for automated Ops.**
**One ~45 min. DSN pass per orbit to dump stored data, with 1 pass fault tolerance.**
**Stored commands switch IMAGE between high/lo RF modes at BOA/EOA of DSN passes.**
**Automated passes including recorder dump, recorder management, health & safety checks.**
**IMAGE operated by MD + 2.25 FOT.**
**L0 and L1 science products made in SMOC.**

## Mission Success

**9 Awards, 37 Discoveries**
**> 400 Peer-Reviewed Papers**
**21 MS and Ph.D Theses**
**2 year design life.**
**Successful 2001, 2003, 2005 SEC Senior Reviews**
**Confirmations: plasma plume creation, post-midnight peak in storm plasmas, neutral solar wind, terrestrial origin of geospace storm plasmas and continuous nature of magnetic reconnection.**
**Discoveries: plasmaspheric shoulders and notches, proton auroras in unexpected places, surprisingly slow plasmasphere rotation, a hot oxygen geocoronoa and a secondary interstellar neutral atom stream.**
**Resolutions: the source of kilometric continuum radiation, solar-wind and auroral intensity effects on ionospheric outflow and the relationship between proton and electron auroras during geospace storms.**

- See more at http://image.gsfc.nasa.gov

## Significant Ops History

| Time |  | Event |
| --- | --- | --- |
|  | 3/25 | Launch from VAFB on Delta II. |
|  | 3/25 | In Orbit Checkout largely nominal, except for Nutation Damper,  MMM overwrite bug, Clock drift greater than expected.  AST retry default increased.  RPI deployment completed 2000/05/11, and full instrument checkout begins immediately after. |
|  | 5/16 | RPI Y-axis transmitter fails.  RPI s/w ‘fuse’ uploaded on 2000/06/12. |
|  | 6/17 | CIDP TAS safes payload due to spin-rate oscillations.  TAS Patch 1 on Dec 13. |
|  | 10/03 | Loss of approximately 130m of RPI -X causes loss of spin balance. |
|  | 1/11 | CIDP reboot due to multiple uncorrectable bit errors during large CME. |
|  | 9/18 | Lost approximately 25m of RPI -Y axis antenna. |
|  | 10/11 | CIDP TAS safes payload due to sun-cross error due to extreme sun angle. |
|  | 8/09 | Lost RPI +Y tip mass and negligible length of wire.  Believed to be caused by orbital debris. |
|  | 2/15 | CIDP reboot due to SEU. |
|  | 3/30 | Begin 2003 Mega-Eclipse season.  Eclipses in excess of IMAGEs prime mission design.  Payload power-safed by S/C FDC macro's.  2003/04/08 SCU reboot due to S/C FDC power macros.  Stored command brought heaters online too soon after eclipse exit. |
|  | 9/30 | Lost most/all of RPI +Y antenna |
|  | 11/25 | SCU warm reboot due to PDU FDC.  SCU Power Supply switched from  A to B. |
|  | 2/01 | SCU warm reboot.  Cause TBD.  SCU Power Supply still on B side. |
|  | 8/09 | CIDP reboot, believed cause by SEU. |
|  | 12/18 | Loss of IMAGE RF signal. |

- 2000

- 2001

- 02

- 2004

- 2005

- 2003

## ANOMALY EVENT & RESPONSE

**Rick Burley, IMAGE Mission Director**

## Anomaly Event & Response

**IMAGE activities and status at the time of the event.**
- No unusual activities/commanding going on at the time.
- All telemetry indicated nominal subsystem status leading up to the end of the last successful contact.
- Space Weather was quiet at the time.
**Anomaly Response Summary.**
- Additional DSN resources employed.
- Sent commands to recycle and configure the transmitter.
- USSTRATCOM Collision assessment confirmed no debris within 50km of IMAGE.
- FRB initiated.

## Pre-Anomaly Ops Timeline Summary

| 2005/352 0714 | All instruments to full science |
| --- | --- |
| 2005/352 0740 | End of Good DSN pass @DS-34 (see diagram) |
| 
2005/352 0755 | Configure RF for low-rate via stored command |
| 2005/352 1125 | IMAGE at apogee |
| 2005/352 1515 | Configure RF to high-rate via stored command |
| 2005/352 1620 | No IMAGE RF signal @DS-34 |

**GMT**

**Activity**

**Pre-Anomaly Ops Timeline Summary**

**~ 8.5 hours elapsed between the last successful and the first failed contacts.**

**Notes:**
No instrument commands between end of good pass and start of failed pass.
Only s/c commands were normal RF mode changes.

-Lose MET column.
-condense science activity to ‘Instruments in nominal science mode’ top and bottom and include GMTs

## Trends all Nominal

_**Trends are inline with previous years.**_
**All systems nominal during last pass.**

## Anomaly Response Summary (1 of 2)

**12/18    ****	****IMAGE MD contacted by DSN Operations Chief about imminent pass ****	****	****failure at DS34 due to no RF signal.  We switched support from DS34 to ****	****	****DS44 in the event of an undiagnosed problem with DS34.  Still no signal.  ****	****	****Scheduled an emergency pass at DS66.  Alerted IMAGE team.**
**12/18****	****During DS66 pass we sent commands in the blind to IMAGE to turn ****	****	****transmitter on/off/on, to switch from MGA to LGA's, Direct Modulation ****	****	****on/off, Subcarrier modulation off/on, coherent mode off/on, ranging ****	****	****off/on.  Still no signal.  Issued Anomaly report.**
**12/19****	****Continued attempts to contact IMAGE without success.  Sent PDU Reset ****	****	****commands.  Trend data analysis does not suggest any cause.  Had DSN ****	****	****reload antenna pointing data.  Verified antenna pointing with predicts and ****	****	****antenna Az/El reported in 0158 Monitor Blocks.  IMAGE MD, in ****	****	****	****consultation with other elements of IMAGE team decide to wait for 72 ****	****	****hour watchdog timer.**
**12/20****	****Berkeley Ground Station reports no RF signal from IMAGE.  BGS had ****	****	****tracked IMAGE during part of it's mission for R/T science data.  Using ****	****	****BGS eliminated possibility of undiagnosed, systemic DSN problem.**

_***2005***_

## Anomaly Response Summary (2 of 2)

**12/21****	****72 hours from last known command to reach IMAGE.  Still no RF ****	****	****	****signal.**
**12/22****	****72 hours from last attempted command to reach IMAGE.  Still no RF ****	****	****signal, even on DS43.  USSTRATCOM Collision assessment reports ****	****	****no debris within 50km of IMAGE, and updated TLEs made with ****	****	****	****active radar match JPLs, and and suggests no impact-induced Delta-V.**
**12/23****	****Resume regular blind commanding in attempt to revive IMAGE with ****	****	****increasing uplink power.**
**1/11    ****	****NORAD contacted for for fault isolation testing support.  Ask if they ****	****	****could observe us optically to detect commanded changes in spin ****	****	****rate, thermal condition, and RPI aliveness.  Not yet aware of AMOS ****	****	****capabilities for this type of support.**
**1/13****	****SSPC failure/recovery mode hypothesized.**
**1/18****	****Recovery plan forwarded to JPL to start planning.**
**1/26****	****SSPCCntl (Transponder) command uncommented from command ****	****	****database and sent repeatedly without effect.**
**1/27****	****IMAGE FRB begins.**

_***2006***_

- Michael Prior
- HST Deputy Ops Manager &
- IMAGE FRB Chairman/Code 581

## Fault Analysis Introduction

**Fault analysis considered IMAGE System FMEA and other possible causes.**
- Only single faults considered.
**System Level FMEA contains many “mission loss” events that can be ruled out.**
- Most would still result in Carrier Wave transmission by the spacecraft.
- Examples:
- Loss of Central Instrument Data Processing Computer (CIDP) results in total loss of the mission but would still allow basic communications capability.
- Total loss of both 1553 Buses would still allow CW transmission.
**Air Force Maui Optical & Supercomputing (AMOS) performed several observations of IMAGE to measure both spin rate and body temperature that have been incorporated into analysis.**
- Follow-up observations have not been completed due to inclement weather in Hawaii.
- Support has been outstanding.

## Cmd Test Using AMOS

**Objective**:  Determine whether IMAGE can receive and respond to commands.
**Method**:  Observe IMAGE using AMOS resources prior to and after commanding the spacecraft.
- Commands sent to both increase spin rate and activate payload heaters.
- The ability to receive commands is key to distinguishing between a Transponder and other failures.
**Multiple observations taken during sunlit and eclipse periods.**
- Pre-Cmd: Jan 28, 31, Feb 16.
- Post Cmd: Feb 19, 22, 25, 28, Mar 13, 19, 22, April 10,13.  All rained out!
- Next opportunity is April 24.
- Photometry and Long Wave Infrared (LWIR) data taken during all observations.
- All successful baseline observations had good views to the spacecraft sides and only limited viewing of top or bottom.

## Cmd Test Using AMOS

**Pre-Cmd Measurements**
**Spin Rate**
- Last estimate from IMAGE operations: 0.477 RPM.
- AMOS measurements: 0.478 +/- 0.005 RPM.
**Overall Spacecraft Body Temperature**
- Thermal modeling prediction: 260 – 303 K (+/- 5 K).
- AMOS measurement: 250 - 310 K (+/- 2 K)
**Post-Cmd Measurements***
**Spin Rate**
- Magnetic control system activated: Spin rate target was 0.52 RPM.
**Body Temperature**
- CIDP side A & B commanded on.
- Raised the deckplate heater setpoints under CIDP and HENA to 18-20 deg. C.

- *Spin up and payload heater commanding performed on 2-16 and again on 3-2.

## Thermal Analysis and AMOS

**Objective:  Determine whether IMAGE is safed or ‘dead’.**
**Method:  Measure IMAGE average body temperatures using AMOS observations and compare to thermal model predictions.**
- Geometric and Math models were generated by the Thermal Branch.
- Incorporates environmental heat fluxes and orbital profile to create temperature predictions.
- GSFC Thermal Coatings Committee provided estimates for solar absorption at 6 year age.
- Solar arrays dominate the temperature signature of the sides during all modes of operation in all orbital conditions due to large area in comparison with radiators (~9:1).
- Top panel solar arrays are important when temperature of both top and sides are measured.
**Comparison is *****inconclusive*****.**

## Fishbone

**Fishbone**

**Loss Of Communications**

**SCU**

** ****DSN Misconfiguration**

**Operations**

**Transponder Failure**

**Power**

**RF System**

**SA Failure**

** ****Stored commanding error**

**RF Component Failures**

**Battery Failure**

**Equipment Short**

** ****SCU Failure**

**Environment**

** ****Misconfiguration of **
**Watchdog Timer**

**SPACECRAFT**

**OTHER CAUSES**

**PDU**

** ****HLD Driver to Txpndr**

** ****SSPC Instant Trip**

** ****PDU ESN/Processor**

** ****Charge Control Failure**

** ****GSE Relay Failure**

** ****SSPC Failure**

** ****Space Weather**

** ****Debris Impact/Collision**

** ****Electrostatic Discharge**

** ****Tin Whiskers**

## Power System Overview

**Power System Overview**

## Cause: Loss of the SCU due to an internal power or CPU failure.
Analysis:  
The Transmitter OFF command is not stored in the SCU.  
It can be executed by the PDU in the event of a bus low voltage condition.
An SCU short would cause its power service to trip (via the SSPC) prior to a bus low voltage condition.
The Transponder OFF command cannot be executed except internally by the PDU as a result of a low voltage condition (see Stored Command Error). 
The spacecraft has been in broadcast mode since launch.  With the stoppage of telemetry, due to loss of SCU functionality, the Transmitter would still have been broadcasting Carrier Wave (CW) that would have been detectable from a ground station.
Conclusion:  An SCU power failure would manifest in a very similar manner to an SCU CPU failure in that telemetry data would cease but Transmitter CW would persist.  Since no CW was detected, a failure in the SCU cannot be a cause of the lost communications. 

**Analysis:**
- The Transmitter OFF command is not stored in the SCU.
**It can be executed by the PDU in the event of a bus low voltage condition.**
**An SCU short would cause its power service to trip (via the ****SSPC****) prior to a bus low voltage condition.**
- The Transponder OFF command cannot be executed except internally by the PDU as a result of a low voltage condition (see Stored Command Error).
*The spacecraft has been in broadcast mode since launch*.  With the stoppage of telemetry, due to loss of SCU functionality, the Transmitter would still have been broadcasting Carrier Wave (CW) that would have been detectable from a ground station.
**Conclusion:**  An SCU power failure would manifest in a very similar manner to an SCU CPU failure in that telemetry data would cease but Transmitter CW would persist.  Since no CW was detected, a failure in the SCU cannot be a cause of the lost communications.

**SCU Power or CPU Failure**

## Cause:  A persistent and systematic DSN misconfiguration is preventing DSN communications with IMAGE.
Analysis:  
Multiple attempts to contact IMAGE were made by the 26m, 34m, and 70m systems.
Antenna pointing data was reloaded and checked against predicts from MMNav that showed no errors or mistaken Two Line Elements (TLE) files were being used.
Additionally, other missions being supported by the DSN suffered no unexpected service outages during the time period in which contact with IMAGE was lost.  
The Berkeley Ground Station (BGS) was brought up as an outside independent resource.  BGS had tracked IMAGE during part of its mission for R/T science data.  BGS reported no RF signal from IMAGE.  
Conclusion:  A persistent and systemic DSN misconfiguration preventing communications contact with IMAGE is a highly improbable cause of the anomaly and is ruled out. 

**Analysis:  **
- Multiple attempts to contact IMAGE were made by the 26m, 34m, and 70m systems.
- Antenna pointing data was reloaded and checked against predicts from MMNav that showed no errors or mistaken Two Line Elements (TLE) files were being used.
- Additionally, other missions being supported by the DSN suffered no unexpected service outages during the time period in which contact with IMAGE was lost.
- The Berkeley Ground Station (BGS) was brought up as an outside independent resource.  BGS had tracked IMAGE during part of its mission for R/T science data.  BGS reported no RF signal from IMAGE.
**Conclusion:**  A persistent and systemic DSN misconfiguration preventing communications contact with IMAGE is a highly improbable cause of the anomaly and is ruled out.

**DSN Misconfiguration**

## Cause:  A command existed in the command load that permanently disabled communications.
Analysis:  
A review of the command load at the time of the anomaly showed that there were only s/c stored commands for nominal RF mode reconfigurations.
Although the command to turn OFF/ON the power feed to the Transponder (via an SSPC) was in the database, it had been commented out since launch, and was thus not an active command.  
If the SSPC OFF command had been inadvertently included into the command upload and executed, the PDU would have rejected it by design.   
Other inadvertent commanding could only possibly result in subsystem misconfigurations that would be detected by onboard safing logic.  
Conclusion:  An erroneous command placed into the stored command load and executed onboard could only result, at most, in a temporary loss of communications.

**Analysis:  **
- A review of the command load at the time of the anomaly showed that there were only s/c stored commands for nominal RF mode reconfigurations.
- Although the command to turn OFF/ON the power feed to the Transponder (via an SSPC) was in the database, it had been commented out since launch, and was thus not an active command.
- If the SSPC OFF command had been inadvertently included into the command upload and executed, the PDU would have rejected it by design.
- Other inadvertent commanding could only possibly result in subsystem misconfigurations that would be detected by onboard safing logic.
**Conclusion:**  An erroneous command placed into the stored command load and executed onboard could only result, at most, in a temporary loss of communications.

**Stored Commanding Error**

## Cause:  Inadvertent setting of PDU or SCU watchdog timer threshold.

Analysis:  
The SCU watchdog timer has an associated time limit threshold within which the watchdog timer must be reset.  If the threshold value were inadvertently set to zero, then the SCU would constantly reboot.   The PDU has a watchdog timer that is reset by the SCU keep alive signal.  Setting its threshold to zero would also result in a constant SCU reboot.
However, since a watchdog timer forced reset would not turn the Transmitter OFF and the reboot macro contains commands to turn the transmitter ON, then CW transmission would still occur and would be detectable from a ground station.
Commands to change both watchdog timer thresholds are not possible due to the configuration of the command loader system.

Conclusion:  Inadvertent configuration of a watchdog timer cannot be the cause for the persistent loss of communications with IMAGE.  

**Analysis:  **
- The SCU watchdog timer has an associated time limit threshold within which the watchdog timer must be reset.  If the threshold value were inadvertently set to zero, then the SCU would constantly reboot.   The PDU has a watchdog timer that is reset by the SCU keep alive signal.  Setting its threshold to zero would also result in a constant SCU reboot.
- However, since a watchdog timer forced reset would not turn the Transmitter OFF and the reboot macro contains commands to turn the transmitter ON, then CW transmission would still occur and would be detectable from a ground station.
- Commands to change both watchdog timer thresholds are not possible due to the configuration of the command loader system.
**Conclusion:  **Inadvertent configuration of a watchdog timer cannot be the cause for the persistent loss of communications with IMAGE.

**Watchdog Timer**

- Scott Hull/Code 592

## Fault TreeEnvironment Cases

**Loss Of Communications**

**SCU**

** ****DSN Misconfiguration**

**Operations**

**PDU**

**Transponder Failure**

**Power**

**RF System**

**SA Failure**

** ****HLD Driver to Txpndr**

** ****Stored commanding error**

** ****SSPC Instant Trip**

**RF Component Failures**

** ****PDU ESN/Processor**

** ****Charge Control Failure**

** ****GSE Relay Failure**

**Battery Failure**

** ****SSPC Failure**

**Equipment Short**

** ****Space Weather**

** ****Debris Impact/Collision**

** ****SCU Failure**

** ****Electrostatic Discharge**

**Environment**

** ****Misconfiguration of **
**Watchdog Timer**

**SPACECRAFT**

**OTHER CAUSES**

** ****Tin Whiskers**

## The IMAGE orbit flies through both the inner and outer of Earth’s radiation belts.  NOAA data indicates a quiet space environment in the week before and after the IMAGE event. The Space Weather Highlights report from Dec 12-18 indicated:
“Solar activity ranged from very low to low during the period...The geomagnetic field during this time was mostly quiet with isolated active periods at high latitudes late on 12 December and again around midday on 17 December”
While a quiet immediate Space Environment makes it unlikely that the December 18 anomaly was related to solar particle events there are other factors to consider: 
A quiet Sun-earth environment permits deeper penetration of SEU causing cosmic rays closer to the Earth. IMAGE was still subject to the trapped radiation environment; 
In the past IMAGE did have parts of the spacecraft showing behavior that was attributed to the space environment (an RPI software latch up, a hung MENA/CIDP interface and a CIDP reboot among others); 
Effects may not manifest themselves immediately, so isolating the cause to the environment may be difficult
See SSPC failure cases for more discussion.

- “Solar activity ranged from very low to low during the period...The geomagnetic field during this time was mostly quiet with isolated active periods at high latitudes late on 12 December and again around midday on 17 December”
**While a quiet immediate Space Environment makes it unlikely that the December 18 anomaly was related to solar particle events there are other factors to consider: **
- A quiet Sun-earth environment permits deeper penetration of SEU causing cosmic rays closer to the Earth. IMAGE was still subject to the trapped radiation environment;
- In the past IMAGE did have parts of the spacecraft showing behavior that was attributed to the space environment (an RPI software latch up, a hung MENA/CIDP interface and a CIDP reboot among others);
- Effects may not manifest themselves immediately, so isolating the cause to the environment may be difficult
- See SSPC failure cases for more discussion.

**Space Weather Summary**

## Cause: Catastrophic mechanical damage by orbital debris large object (>10cm) impact 
Analysis: The IMAGE orbit approaches significant orbital debris flux only briefly at perigee (1000-2000km in a 1000 x 44,000km orbit), and the flux is negligible for the majority of the orbit.  IMAGE did, however, pass through perigee during the seven hours following the last successful contact. USSTRATCOM Collision assessment reports no debris within 50km of IMAGE, and updated TLEs made with active radar match JPLs, and suggest no impact-induced Delta-V.
Conclusion: Impact with large debris should cause observable changes in the spacecraft orbit. No such changes occurred.  In addition, no tracked large objects were detected within 50km of the spacecraft at the time of the anomaly, either as a cause or a result of collision.  The IMAGE downlink anomaly could not have been a result of impact with a piece of tracked orbital debris.
Supporting Details: A graph showing the altitude distribution of orbital debris is attached.

**Analysis**: The IMAGE orbit approaches significant orbital debris flux only briefly at perigee (1000-2000km in a 1000 x 44,000km orbit), and the flux is negligible for the majority of the orbit.  IMAGE did, however, pass through perigee during the seven hours following the last successful contact. USSTRATCOM Collision assessment reports no debris within 50km of IMAGE, and updated TLEs made with active radar match JPLs, and suggest no impact-induced Delta-V.
**Conclusion**: Impact with large debris should cause observable changes in the spacecraft orbit. No such changes occurred.  In addition, no tracked large objects were detected within 50km of the spacecraft at the time of the anomaly, either as a cause or a result of collision.  The IMAGE downlink anomaly could not have been a result of impact with a piece of tracked orbital debris.
**Supporting Details: **A graph showing the altitude distribution of orbital debris is attached.

**Orbital Debris Impact****(>10cm diameter)**

## Orbital Debris Flux Distribution(>10cm diameter)

## Cause: Micrometeoroid or orbital debris (MM/OD) impact (<10cm diameter)
Analysis: Man-made debris is concentrated at 500 to 1500 kilometers altitude, a region which the IMAGE orbit crosses only briefly.  Small micrometeoroid flux is comparable, but distributed evenly throughout the orbit.  A random small object at high velocity (as high as 70km/sec for micrometeoroids) could pass through the spacecraft wall and penetrate the transponder or PDU, causing box failure.  
Conclusion: The likelihood of an MM/OD impact on the transponder is extremely low, due to the geometry involved and the relatively low particle flux, but it can not be ruled out.   MM/OD damage is a possible cause for the IMAGE downlink anomaly, but it is very unlikely.
Supporting Details: A graph showing the size distribution of micrometeoroids is attached.

**Analysis**: Man-made debris is concentrated at 500 to 1500 kilometers altitude, a region which the IMAGE orbit crosses only briefly.  Small micrometeoroid flux is comparable, but distributed evenly throughout the orbit.  A random small object at high velocity (as high as 70km/sec for micrometeoroids) could pass through the spacecraft wall and penetrate the transponder or PDU, causing box failure.
**Conclusion**: The likelihood of an MM/OD impact on the transponder is extremely low, due to the geometry involved and the relatively low particle flux, but it can not be ruled out.   MM/OD damage is a possible cause for the IMAGE downlink anomaly, but it is very unlikely.
**Supporting Details: **A graph showing the size distribution of micrometeoroids is attached.

**MM/OD Impact****(<10cm)**

## Micrometeoroid Flux Size Distribution

- Mike Powers/Code 567

## Fault TreeRF System Cases

**Loss Of Communications**

**SCU**

** ****DSN Misconfiguration**

**Operations**

**PDU**

**Transponder Failure**

**Power**

**RF System**

**SA Failure**

** ****HLD Driver to Txpndr**

** ****Stored commanding error**

** ****SSPC Instant Trip**

**RF Component Failures**

** ****PDU ESN/Processor**

** ****Charge Control Failure**

** ****GSE Relay Failure**

**Battery Failure**

** ****SSPC Failure**

**Equipment Short**

** ****Space Weather**

** ****Debris Impact/Collision**

** ****SCU Failure**

** ****Electrostatic Discharge**

**Environment**

** ****Misconfiguration of **
**Watchdog Timer**

**SPACECRAFT**

**OTHER CAUSES**

** ****Tin Whiskers**

## Fault Analysis – RF System

**IMAGE RF System Block Diagram**

- (

- T

- o

- p

- o

- f

- M

- G

- A

- )

- (

- Z

- -

- )

- (

- Z

- +

- )

- P

- o

- w

- e

- r

- C

- o

- m

- b

- i

- n

- e

- r

- /

- S

- p

- l

- i

- t

- t

- e

- r

- D

- i

- p

- l

- e

- x

- e

- r

- T

- r

- a

- n

- s

- m

- i

- t

- t

- e

- r

- L

- G

- A

- 2

- L

- G

- A

- 2

- L

- G

- A

- 1

- M

- G

- A

- A

- n

- t

- e

- n

- n

- a

- S

- y

- s

- t

- e

- m

- O

- M

- N

- I

- M

- G

- A

- R

- e

- c

- e

- i

- v

- e

- r

- /

- D

- e

- t

- e

- c

- t

- o

- r

- R

- S

- 4

- 2

- 2

- D

- a

- t

- a

- I

- n

- t

- e

- r

- f

- a

- c

- e

- T

- r

- a

- n

- s

- p

- o

- n

- d

- e

- r

- R

- F

- S

- w

- i

- t

- c

- h

- i

- n

- g

- a

- n

- d

- R

- o

- u

- t

- i

- n

- g

- S

- y

- s

- t

- e

- m

- C

- o

- n

- t

- r

- o

- l

- U

- n

- i

- t

- (

- S

- C

- U

- )

- 50 Ohm Termination

**SSPC +28V**
**Switched Service**
- (single SSPC services
-  both Rx and Tx)

## Cause:  Simultaneous Transmitter/Receiver Failure.
Analysis:  
The transmitter and receiver sections of the transponder are functionally independent with separate power converters, although both power converters share the same power feed via an SSPC.
20 critical functions of the transponder are identified in the FMEA.  Failure of any one of those functions will kill either the transmitter or receiver, but not both.  
The IMAGE transponder has no history of anomalous behavior throughout its mission life in either the transmitter or receiver.  All telemetry trend data has been analyzed and indicates nominal operation up to the last contact.
Conclusion:  Failure of both the transmitter and receiver sections of the transponder is unlikely, as it would require loss of two separate critical functions within the unit.  Coupled with the reliable history on IMAGE and other missions, it is very unlikely the Transponder itself is the cause of the spacecraft’s failed communications.  Failure of the receiver cannot be the cause since the transmitter would continue to function.  However, failure of the transmitter alone cannot be ruled out as the root cause (although very unlikely).

**Analysis:**
- The transmitter and receiver sections of the transponder are functionally independent with separate power converters, although both power converters share the same power feed via an SSPC.
**20 critical functions of the transponder are identified in the FMEA.  Failure of any one of those functions will kill either the transmitter or receiver, but not both.  **
- The IMAGE transponder has no history of anomalous behavior throughout its mission life in either the transmitter or receiver.  All telemetry trend data has been analyzed and indicates nominal operation up to the last contact.
**Conclusion:**  Failure of both the transmitter and receiver sections of the transponder is unlikely, as it would require loss of two separate critical functions within the unit.  Coupled with the reliable history on IMAGE and other missions, it is very unlikely the Transponder itself is the cause of the spacecraft’s failed communications.  Failure of the receiver cannot be the cause since the transmitter would continue to function.  However, failure of the transmitter alone cannot be ruled out as the root cause (although very unlikely).

**Transponder Failure**

## Supporting Details: 
Transponder telemetry trend data and FMEA are available. The transponder, an L-3 Telemetry West Model CXS-600B, has a reliable flight history. Eleven functionally similar transponders have successfully flown on 8 GSFC-managed missions with no on-orbit failures or significant anomalies:
 [ACE (2), FUSE (2), TRACE, WIRE, EO-1, WMAP (2), QUICKSCAT, and ICESAT]. 
In addition, the CXS-600B has flown on at least 8 other missions with no on-orbit failures or significant anomalies:
DSPSE [Clementine/NRL], Minisat [Inisel Espacio], CRSS/IKONOS [LM/Sunnyvale] , KOMPSAT [Korean Aerospace], LUNAR PROSPECTOR [LM/Sunnyvale], SSTI [TRW], VCL [OSC], GENESIS [LM/Denver].

- Transponder telemetry trend data and FMEA are available. The transponder, an L-3 Telemetry West Model CXS-600B, has a reliable flight history. Eleven functionally similar transponders have successfully flown on 8 GSFC-managed missions with no on-orbit failures or significant anomalies:
** ****[ACE (2), FUSE (2), TRACE, WIRE, EO-1, WMAP (2), QUICKSCAT, and ICESAT]. **
- In addition, the CXS-600B has flown on at least 8 other missions with no on-orbit failures or significant anomalies:
**DSPSE [Clementine/NRL], Minisat [Inisel Espacio], CRSS/IKONOS [LM/Sunnyvale] , KOMPSAT [Korean Aerospace], LUNAR PROSPECTOR [LM/Sunnyvale], SSTI [TRW], VCL [OSC], GENESIS [LM/Denver].**

**Transponder Failure (cont.)**

## Cause:  Failure of an antenna or RF network component (diplexer, power splitter, switches, or cables).
Analysis:  
Failure of any one antenna or RF network component cannot cause failure to both the uplink path and downlink path by design.
A single antenna failure may cause a temporary loss of Rx or Tx capability.  However, an SCU reset would configure for dual omni mode that would restore one or both capabilities.
All antennas and RF network components are passive (except for the switches, which are mechanical latching relays that have only been exercised a few times after launch). Overall operation of the RF system has been steady state operation with very infrequent changes of state, minimizing any potential failures.  
Conclusion:  Failure of any component after 6 years of trouble free operation in a steady state operational mode is highly unlikely (a dual failure is extremely remote).  Even in the event of a failure, one of either command or telemetry capability would remain – which has not been observed.  A failure in the RF system (outside the Transponder) is highly unlikely to result in the inability to communicate with the spacecraft.

**Analysis**:
- Failure of any one antenna or RF network component cannot cause failure to both the uplink path and downlink path by design.
**A single antenna failure may cause a temporary loss of Rx or Tx capability.  However, an SCU reset would configure for dual omni mode that would restore one or both capabilities.**
- All antennas and RF network components are passive (except for the switches, which are mechanical latching relays that have only been exercised a few times after launch). Overall operation of the RF system has been steady state operation with very infrequent changes of state, minimizing any potential failures.
**Conclusion**:  Failure of any component after 6 years of trouble free operation in a steady state operational mode is highly unlikely (a dual failure is extremely remote).  Even in the event of a failure, one of either command or telemetry capability would remain – which has not been observed.  A failure in the RF system (outside the Transponder) is highly unlikely to result in the inability to communicate with the spacecraft.

**Antenna/RF Network Failure**

## Amri I. Hernández-Pellerano
GSFC, Code 563

**Amri I. Hernández-Pellerano**
**GSFC, Code 563**

## Fault TreePower System Cases

**Loss Of Communications**

**SCU**

** ****DSN Misconfiguration**

**Operations**

**PDU**

**Transponder Failure**

**Power**

**RF System**

**SA Failure**

** ****HLD Driver to Txpndr**

** ****Stored commanding error**

** ****SSPC Instant Trip**

**RF Component Failures**

** ****PDU ESN/Processor**

** ****Charge Control Failure**

** ****GSE Relay Failure**

**Battery Failure**

** ****SSPC Failure**

**Equipment Short**

** ****Space Weather**

** ****Debris Impact/Collision**

** ****SCU Failure**

** ****Electrostatic Discharge**

**Environment**

** ****Misconfiguration of **
**Watchdog Timer**

**SPACECRAFT**

**OTHER CAUSES**

** ****Tin Whiskers**

## Cause:  Battery internal short. 
Analysis:  
The battery consists of 22 individual cells in series.  An internal short in a single cell would change the power bus voltage by a maximum of 1.7V,  not substantially enough to affect equipment operation. The bus design can accommodate voltage ranges from 24 to 32 VDC.  
Only multiple simultaneous cell shorting could effectively short the bus and fail the spacecraft power system resulting in complete loss of communications. 
Conclusion:  IMAGE has no history of battery anomalies.  All available telemetry showed healthy batteries and no indication of cell shorting or other battery degradation.  The probability of multiple cell shorting over a short period (~8.5 hours*) is highly improbable.   Battery shorting is a highly unlikely cause for the failed communications capability. 
Supporting Details: Battery/bus Voltage trend under typical load.

**Analysis**:
- The battery consists of 22 individual cells in series.  An internal short in a single cell would change the power bus voltage by a maximum of 1.7V,  not substantially enough to affect equipment operation. The bus design can accommodate voltage ranges from 24 to 32 VDC.
- Only multiple simultaneous cell shorting could effectively short the bus and fail the spacecraft power system resulting in complete loss of communications.
**Conclusion**:  IMAGE has no history of battery anomalies.  All available telemetry showed healthy batteries and no indication of cell shorting or other battery degradation.  The probability of multiple cell shorting over a short period (~8.5 hours*) is highly improbable.   Battery shorting is a highly unlikely cause for the failed communications capability.** **
**Supporting Details: **Battery/bus Voltage trend under typical load.

**Battery Failure**

- *8.5 hours is the time between the last successful contact and the failed contact.

## Cause:  Battery internal open. 
Analysis:  
Any single cell suffering an open circuit type failure would halt the ability of the battery to generate current and service the load.  
However, during sunlight the Array will charge the bus capacitance until the over-voltage protection clamps the bus voltage to 35V. 
The Transponder and other spacecraft equipment would continue to function normally without interruption in operation.
Loss of bus voltage would occur during eclipse periods.
Conclusion:  The loss of communications event occurred during a period of continuous sunlight (no eclipse).  If a battery open cell failure had occurred, the Transponder would have continued functioning with no loss of communications occurring.  A battery open cell failure cannot be a cause of the failed communications.
Supporting Details: Battery/bus Voltage trend under typical load.

**Analysis**:
- Any single cell suffering an open circuit type failure would halt the ability of the battery to generate current and service the load.
- However, during sunlight the Array will charge the bus capacitance until the over-voltage protection clamps the bus voltage to 35V.
**The Transponder and other spacecraft equipment would continue to function normally without interruption in operation.**
**Loss of bus voltage would occur during eclipse periods.**
**Conclusion**:  The loss of communications event occurred during a period of continuous sunlight (no eclipse).  If a battery open cell failure had occurred, the Transponder would have continued functioning with no loss of communications occurring.  A battery open cell failure cannot be a cause of the failed communications.
**Supporting Details: **Battery/bus Voltage trend under typical load.

**Battery Failure**

## Battery FailureTrends Under Typical Load

- BSOC
- T_batt
- V_batt
- V_bus
- I_load
- I_batt

## Cause:  Solar array failure (short/open) 
Analysis:  The strings from the panels are grouped into 6 segments feeding the PDU. A short or open somewhere between the array and PDU will most likely affect the output of a single string (1.6%). But even if all the strings forming a segment from the array panels short before the PDU input, the spacecraft would lose only about 16.7% of available power. There would be no significant loss of spacecraft functionality. The array configuration uses blocking diodes and bypasses which means that, in the event of a short or open in a cell, a single cell failure will not take out an entire string.
Conclusion:  IMAGE has no flight history of solar array anomalies.  All available telemetry showed a healthy array with the degradation less than expected in its extended mission. The configuration of the array makes it highly unlikely that a failure involving a short or open between the array panels and the PDU input or a failure involving a significant number of individual cells is the cause of IMAGE’s inability to communicate. 
Supporting Details: Solar array current trend. Solar array and PDU interface block diagram.

**Analysis**:  The strings from the panels are grouped into 6 segments feeding the PDU. A short or open somewhere between the array and PDU will most likely affect the output of a single string (1.6%). But even if all the strings forming a segment from the array panels short before the PDU input, the spacecraft would lose only about 16.7% of available power. There would be no significant loss of spacecraft functionality. The array configuration uses blocking diodes and bypasses which means that, in the event of a short or open in a cell, a single cell failure will not take out an entire string.
**Conclusion**:  IMAGE has no flight history of solar array anomalies.  All available telemetry showed a healthy array with the degradation less than expected in its extended mission. The configuration of the array makes it highly unlikely that a failure involving a short or open between the array panels and the PDU input or a failure involving a significant number of individual cells is the cause of IMAGE’s inability to communicate.
**Supporting Details: **Solar array current trend. Solar array and PDU interface block diagram.

**Solar Array Failure**

## Solar Array FailureArray Schematic

## Cause:  Short to ground in on-board equipment. 
Analysis:  There are two general cases for the consideration of a short.  
The first is a short within a component whose power is serviced by over-current protected switches (SSPC and PVMOSFET circuits).   
Most spacecraft equipment (loads) falls into this classification .  
Any large short circuit would trip the over current circuit breaker logic and remove power from the troubled component.  This would be reported in telemetry and no loss of communication capability would occur.  [The exception is the Transponder that is covered in another analysis.] 
The second is a massive short in an unswitched component (battery, solar array and PDU power bus) that would result in a drastic reduction of bus voltage and the general failure of the power system.  This would be unrecoverable. 	
Conclusion:	Although highly unlikely, a sudden massive short in unswitched equipment (i.e. PDU itself) or in the Transponder cannot be ruled out as a possible cause.
Supporting Details: IMAGE has experienced a persistent, low-level chassis current since launch that has been analyzed (see backup charts).  Analysis indicates it is very unlikely that the current progressed into a catastrophic short in the brief time between the last successful and failed contacts.

**Analysis**:  There are two general cases for the consideration of a short.
- The first is a short within a component whose power is serviced by over-current protected switches (SSPC and PVMOSFET circuits).
- Most spacecraft equipment (loads) falls into this classification .
- Any large short circuit would trip the over current circuit breaker logic and remove power from the troubled component.  This would be reported in telemetry and no loss of communication capability would occur.  [The exception is the Transponder that is covered in another analysis.]
- The second is a massive short in an unswitched component (battery, solar array and PDU power bus) that would result in a drastic reduction of bus voltage and the general failure of the power system.  This would be unrecoverable.** ****	**
**Conclusion**:	Although highly unlikely, a sudden massive short in unswitched equipment (i.e. PDU itself) or in the Transponder cannot be ruled out as a possible cause.
**Supporting Details: **IMAGE has experienced a persistent, low-level chassis current since launch that has been analyzed (see backup charts).  Analysis indicates it is very unlikely that the current progressed into a catastrophic short in the brief time between the last successful and failed contacts.

**Equipment Short**

## Fault Tree PDU Electronics Cases

**Loss Of Communications**

**SCU**

** ****DSN Misconfiguration**

**Operations**

**PDU**

**Transponder Failure**

**Power**

**RF System**

**SA Failure**

** ****HLD Driver to Txpndr**

** ****Stored commanding error**

** ****SSPC Instant Trip**

**RF Component Failures**

** ****PDU ESN/Processor**

** ****Charge Control Failure**

** ****GSE Relay Failure**

**Battery Failure**

** ****SSPC Failure**

**Equipment Short**

** ****Space Weather**

** ****SCU Failure**

** ****Electrostatic Discharge**

**Environment**

** ****Misconfiguration of **
**Watchdog Timer**

**SPACECRAFT**

**OTHER CAUSES**

** ****Tin Whiskers**

** ****Debris Impact/Collision**

## Power System Overview

## Cause:  GSE/Battery relay switched to ground source 
Analysis:  The spacecraft has a relay that was used in I&T to control the application of either the spacecraft’s battery or GSE supplied power to the spacecraft bus. 
The relay is controlled through the GSE interface. If the relay were in the GSE position since launch IMAGE would have experienced power loss in previous eclipse seasons. This was not observed.  
If this relay fails in orbit by switching to the GSE source position, battery power to the bus is interrupted.  But the power system design is such that in a full sunlit orbit the bus is clamped to 35V. 
Conclusion: The loss of communications event occurred during a period of continuous sunlight (no eclipse).  If the relay somehow switched to the non flight position, there would have been no observable effect on the spacecraft’s performance (except for higher bus voltage) and  RF transmission would  have continued normally. A GSE relay misconfiguration cannot be a cause of the failed communications capability. 
Supporting Details:  IMAGE launched on battery power.  IMAGE has no on-board circuit capability to change the GSE relay state.

**Analysis:**  The spacecraft has a relay that was used in I&T to control the application of either the spacecraft’s battery or GSE supplied power to the spacecraft bus.
**The relay is controlled through the GSE interface. If the relay were in the GSE position since launch IMAGE would have experienced power loss in previous eclipse seasons. This was not observed.  **
**If this relay fails in orbit by switching to the GSE source position, battery power to the bus is interrupted.  But the power system design is such that in a full sunlit orbit the bus is clamped to 35V. **
**Conclusion:** The loss of communications event occurred during a period of continuous sunlight (no eclipse).  If the relay somehow switched to the non flight position, there would have been no observable effect on the spacecraft’s performance (except for higher bus voltage) and  RF transmission would  have continued normally. A GSE relay misconfiguration cannot be a cause of the failed communications capability.** **
**Supporting Details:**  IMAGE launched on battery power.  IMAGE has no on-board circuit capability to change the GSE relay state.

**GSE Relay Failure**

## GSE Relay Failure

## Cause:  Charge control function fails. 
Analysis:  Four of the six solar array segments are routed to independent shunt circuits to provide coarse control of the battery charge while two of the six are routed to the pulse width modulator (PWM) for the fine control of the battery charge.  
Loss of battery charge control due to an open or short at the circuit connection to the power bus would result in a powerless spacecraft.  
Loss of battery charge control due to loss of the PDU +/-15V converter would result in eventual bus over-voltage and therefore mission loss due to multiple load failures.
Failure on any of the shunt segments is not a failure of the complete charge control but a loss of 16.7% of SA power.  
A failure of the PWM represents a larger current ripple on the bus and a loss of 34% of SA power. 
Conclusion:	 Although unlikely, an open or short at the battery charger to bus connection or loss of the PDU +/-15 converter are possible causes for the loss of communication capability (due to loss of vehicle).	

**Analysis**:  Four of the six solar array segments are routed to independent shunt circuits to provide coarse control of the battery charge while two of the six are routed to the pulse width modulator (PWM) for the fine control of the battery charge.
- Loss of battery charge control due to an open or short at the circuit connection to the power bus would result in a powerless spacecraft.
- Loss of battery charge control due to loss of the PDU +/-15V converter would result in eventual bus over-voltage and therefore mission loss due to multiple load failures.
- Failure on any of the shunt segments is not a failure of the complete charge control but a loss of 16.7% of SA power.
- A failure of the PWM represents a larger current ripple on the bus and a loss of 34% of SA power.
**Conclusion**:	 Although unlikely, an open or short at the battery charger to bus connection or loss of the PDU +/-15 converter are possible causes for the loss of communication capability (due to loss of vehicle).**	**

**Charge Control Failure **

## Supporting Details: With the loss of the +/-15V converter (open, 0v) there is no PDU telemetry and no battery charge control.  
Since the design is a DET system, all the solar array current will be “on the bus”.  Up to 6A could be directed to the fully charged battery.
Eventually the battery will experience cell rupture due to the overcharge.  If the battery reaction “opens” it from the bus, the loads might continue to receive current from the array at a higher bus voltage.
Bus voltage would be between 35V and Voc (up to 91v).  Bus voltages up to 50v might still allow some equipment to function.  Higher voltages would certainly result in total loss of mission due to massive equipment failure.  

- Since the design is a DET system, all the solar array current will be “on the bus”.  Up to 6A could be directed to the fully charged battery.
- Eventually the battery will experience cell rupture due to the overcharge.  If the battery reaction “opens” it from the bus, the loads might continue to receive current from the array at a higher bus voltage.
- Bus voltage would be between 35V and Voc (up to 91v).  Bus voltages up to 50v might still allow some equipment to function.  Higher voltages would certainly result in total loss of mission due to massive equipment failure.

**Charge Control Failure **

## Cause:  PDU ESN processor ceases to function. 
Analysis:  A PDU processor failure means loss of communication between the PDU and the SCU, and loss of primary battery charge control.   
All switched power services should remain in the previous state during an ESN failure.  The possibility of this failure to change the state of any switched load is unlikely due to the combination of signals needed to address a load switch.   
If the PDU loses the software controlled charge mechanism, a backup hardware loop will take over to charge the battery with a bus voltage clamp.  
Conclusion:  An ESN failure cannot be the root cause of the failed communications capability since the Transponder would continue to function nominally in such a scenario.

Supporting Details:	The data interface between the Transponder and the SCU is a direct RS-422 connection that would be unaffected by an ESN failure.  SSPC control block diagram attached.

**Analysis**:  A PDU processor failure means loss of communication between the PDU and the SCU, and loss of primary battery charge control.
- All switched power services should remain in the previous state during an ESN failure.  The possibility of this failure to change the state of any switched load is unlikely due to the combination of signals needed to address a load switch.
- If the PDU loses the software controlled charge mechanism, a backup hardware loop will take over to charge the battery with a bus voltage clamp.
**Conclusion**:  An ESN failure cannot be the root cause of the failed communications capability since the Transponder would continue to function nominally in such a scenario.
**Supporting Details:****	**The data interface between the Transponder and the SCU is a direct RS-422 connection that would be unaffected by an ESN failure.** ** SSPC control** **block diagram attached.

**PDU ESN Failure**

## PDU ESN FailureSSPC Control Block Diagram

## Cause:  High Level Discrete (HLD) Driver for transmitter ON/OFF fails. 
Analysis:  The most likely failure mode of the transmitter HLD concerns three transistors controlling the transmitter on/off state, any of which if shorted allows the controlling relay coil to be continuously energized.
 The transmitter control function was exercised only once so far during the mission when the transmitter turned ON.  The transmitter has been enabled  in broadcast mode ever since.  
Additionally, there are no nominal spacecraft operations that command the transmitter OFF which would exercise the HLD driver. 
Driver failures most likely occur during the pulse command of the relay when the transistors change states.
Conclusion:  Based on the use of the Transmitter ON HLD driver during the mission it is highly unlikely for a failure in this circuit.
Supporting Details:  HLD schematic

**Analysis:**  The most likely failure mode of the transmitter HLD concerns three transistors controlling the transmitter on/off state, any of which if shorted allows the controlling relay coil to be continuously energized.
-  The transmitter control function was exercised only once so far during the mission when the transmitter turned ON.  The transmitter has been enabled  in broadcast mode ever since.
- Additionally, there are no nominal spacecraft operations that command the transmitter OFF which would exercise the HLD driver.
- Driver failures most likely occur during the pulse command of the relay when the transistors change states.
**Conclusion:**  Based on the use of the Transmitter ON HLD driver during the mission it is highly unlikely for a failure in this circuit.
**Supporting Details:**  HLD schematic

**HLD Driver Failure**

## HLD Driver Failure

## HLD Driver Failure

## Cause:  An open across the Transponder Solid State Power Controller (SSPC)
Analysis:  
The Receiver and Transmitter are powered from the same SSPC.  A possible failure scenario for this part is an open of its internal MOSFET.  There are ten MOSFETS in parallel inside this device.  All ten of these would have to fail open in order to lose transponder power.  That is most unlikely unless there is a total failure in the internal drive circuit.
SSPC damage due to Total Ionizing Dosage would be a graceful degradation that would manifest as increased SSPC internal losses.  The result would be noticeable increases in bus load current.   No instant trip or catastrophic failure would result. 
Single-event gate rupture can happen when an energetic particle damages the insulation layer within a MOSFET while it is “off”.  However, current understanding of the SSPC part function indicates that the MOSFETs are energized “on” continuously while carrying current to the transponder.  
Conclusion: An SSPC failure is highly unlikely given the design and operational usage of the part and is therefore not considered as the cause of the loss of communications capability.  

**Analysis**:
- The Receiver and Transmitter are powered from the same SSPC.  A possible failure scenario for this part is an open of its internal MOSFET.  There are ten MOSFETS in parallel inside this device.  All ten of these would have to fail open in order to lose transponder power.  That is most unlikely unless there is a total failure in the internal drive circuit.
- SSPC damage due to Total Ionizing Dosage would be a graceful degradation that would manifest as increased SSPC internal losses.  The result would be noticeable increases in bus load current.   No instant trip or catastrophic failure would result.
- Single-event gate rupture can happen when an energetic particle damages the insulation layer within a MOSFET while it is “off”.  However, current understanding of the SSPC part function indicates that the MOSFETs are energized “on” continuously while carrying current to the transponder.
**Conclusion**: An SSPC failure is highly unlikely given the design and operational usage of the part and is therefore not considered as the cause of the loss of communications capability.

**SSPC Failure **

## SSPC Failure 

**Supporting Details: **
- The IMAGE dose-depth curve indicates that the SSPC has received approximately from 30 to 200 krads total dose in an electron-rich environment (based on 100-200 mils aluminum shielding).  Though neither the SSPC nor the transponder has been specifically tested, typical total dose damage expected for the SSPC is a graceful degradation of the power passed through the part.  The transponder would be expected to draw more current over time that would manifest as an increased bus load current.  Eventually the increased current would trip the SSPC (but not an “Instant Trip”), which would engage the FDC process.
- Based on expected performance, total dose induced damage alone could not produce the IMAGE anomaly, since an SSPC trip would engage FDC processes. In addition, a total dose effect should affect several SSPCs, producing an even greater increase in bus current over time.  No such increase was observed.
- Single-event gate rupture can happen when an energetic particle damages the insulation layer within a MOSFET while it is “off”.  Previous single-event radiation testing on similar RP-21000 series parts within rated parameters produced no permanent damage to the MOSFETs.  It should be noted that the tests were run on a different lot of parts, and the test results may not be completely representative of the flight parts.
- Current understanding of the SSPC part function indicates that the MOSFETs are energized “on” continuously while carrying current to the transponder.  If the current understanding of the part function is correct, single-event gate rupture could not cause of the IMAGE downlink anomaly.

## Cause:  SSPC instant trip resulting in an unrecoverable Transponder OFF condition.
Analysis:  
Several components within the IMAGE spacecraft are serviced by SSPCs, including the Transponder.
The SSPC has built in overcurrent protection that results in an “instant trip” when a high-level current transient is detected.  However, this type of trip condition is not reported in the SSPC status telemetry.  This prevents the on-board FDC logic in the PDU from detecting the device OFF and attempting to reset it to ON.
As a result the device would remain OFF.
The instant trip condition can be caused by radiation induced SEU in the SSPC.
It was attributed as the root cause of three previous on-orbit anomalies on the EO-1 and WMAP missions.
The condition is recoverable by cycling the command line to the device.  
This requires an OFF command followed by an ON command to the particular SSPC.  Even with communication capabilities an OFF command would be rejected.
However, this can be accomplished by a complete bus reset induced by a low voltage condition (<21 Vdc) which might occur during the next deep eclipse cycle in Oct 2007.
Conclusion:  An SEU induced instant trip of the Transponder SSPC is the most likely cause of the loss of communications.  Potential recovery will not be possible until Oct 2007.	

**Analysis**:
- Several components within the IMAGE spacecraft are serviced by SSPCs, including the Transponder.
- The SSPC has built in overcurrent protection that results in an “instant trip” when a high-level current transient is detected.  However, this type of trip condition is not reported in the SSPC status telemetry.  This prevents the on-board FDC logic in the PDU from detecting the device OFF and attempting to reset it to ON.
- As a result the device would remain OFF.
- The instant trip condition can be caused by radiation induced SEU in the SSPC.
- It was attributed as the root cause of three previous on-orbit anomalies on the EO-1 and WMAP missions.
- The condition is recoverable by cycling the command line to the device.
- This requires an OFF command followed by an ON command to the particular SSPC.  Even with communication capabilities an OFF command would be rejected.
- However, this can be accomplished by a complete bus reset induced by a low voltage condition (<21 Vdc) which might occur during the next deep eclipse cycle in Oct 2007.
**Conclusion**:  An SEU induced instant trip of the Transponder SSPC is the most likely cause of the loss of communications.  Potential recovery will not be possible until Oct 2007.**	**

**SSPC Instant Trip **

## Supporting Details:
There are three ways the SSPC can turn OFF power to the output or drive the internal MOSFET OFF.   These are: 
(1) by command, 
(2) by an overload, 
(3) by an instant trip.  
(a) load hard short circuit 
(b) by SEU on the current sense circuit.  
(3a) The instant trip function requires 80A to 120A in about 25usec to open the MOSFET.  If that is the case the problem at the Transponder (load) side would most likely be catastrophic.
This represents loss of communication but a powered spacecraft.
(3b) It has been found in other spacecraft using the ‘same’ part that the instant trip condition was likely caused by an SEU. The Instant trip event is not reported (regardless of cause) in the device’s status signal and is therefore non-detectable by the on board FDC logic.  
This represents potential recovery of communication and a powered spacecraft.
Transponder SSPC is controlled by the PDU FDC logic.  By design, external commands (ground or SCU) to specifically reset this service will be rejected by the PDU.

- There are three ways the SSPC can turn OFF power to the output or drive the internal MOSFET OFF.   These are:
- (1) by command,
- (2) by an overload,
- (3) by an instant trip.
- (a) load hard short circuit
- (b) by SEU on the current sense circuit.
- (3a) The instant trip function requires 80A to 120A in about 25usec to open the MOSFET.  If that is the case the problem at the Transponder (load) side would most likely be catastrophic.
- This represents loss of communication but a powered spacecraft.
- (3b) It has been found in other spacecraft using the ‘same’ part that the instant trip condition was likely caused by an SEU. The Instant trip event is not reported (regardless of cause) in the device’s status signal and is therefore non-detectable by the on board FDC logic.
- This represents potential recovery of communication and a powered spacecraft.
- Transponder SSPC is controlled by the PDU FDC logic.  By design, external commands (ground or SCU) to specifically reset this service will be rejected by the PDU.

**SSPC Instant Trip **

## Supporting Details:
Previous radiation testing on similar RP-21000 series parts within rated parameters produced mostly temporary drop-out transients of no more than 1 millisecond, which self-recovered.  A few persistent dropouts were observed, but it is not known whether these were typical low-level overcurrent trips or Instant Trips.  A single event upset specifically in the Instant Trip portion of the circuit could cause a permanent power loss with no signal to the FDC circuits.  It should be noted that the tests were run on a different lot of parts, and the test results may not be completely representative of the flight parts.
SSPC internal block diagram (next page)

- Previous radiation testing on similar RP-21000 series parts within rated parameters produced mostly temporary drop-out transients of no more than 1 millisecond, which self-recovered.  A few persistent dropouts were observed, but it is not known whether these were typical low-level overcurrent trips or Instant Trips.  A single event upset specifically in the Instant Trip portion of the circuit could cause a permanent power loss with no signal to the FDC circuits.  It should be noted that the tests were run on a different lot of parts, and the test results may not be completely representative of the flight parts.
- SSPC internal block diagram (next page)

**SSPC Instant Trip **

## SSPC Instant TripSSPC Block Diagram

**Diagram from EO-1 SSPC anomaly report.  2001.**

## Fault TreeFinal Result

**Loss Of Communications**

**SCU**

** ****DSN Misconfiguration**

**Operations**

**PDU**

**Transponder Failure**

**Power**

**RF System**

**SA Failure**

** ****HLD Driver to Txpndr**

** ****Stored commanding error**

** ****SSPC Instant Trip**

**RF Component Failures**

** ****PDU ESN/Processor**

** ****Charge Control Failure**

** ****GSE Relay Failure**

**Battery Failure**

** ****SSPC Failure**

**Equipment Short**

** ****Space Weather**

** ****Debris Impact/Collision**

** ****SCU Failure**

** ****Electrostatic Discharge**

**Environment**

** ****Misconfiguration of **
**Watchdog Timer**

**SPACECRAFT**

**OTHER CAUSES**

** ****Tin Whiskers**

## Mission Recovery Scenario

**Mark Tapley**
**Mission System Engineer**
**Southwest Research Institute**
**mtapley@swri.edu  210-522-6025**

## System Reset Due To Long Eclipse

**Orbit Precession Places Apogee in Ecliptic at Times**
**Roughly every 3.5 years**
**Results in Very Long (> 2 hours) Eclipses**
**Next Occurrence October 2007**
**Power System Not Designed for Long-Eclipse Case**
**During Extended Mission, Handled by Special Operations**
**Payload Pre-Heated, saving ~ 6 Amp-Hours Battery Draw**
**Non-necessary Loads (Including Instruments) Turned Off**
**Current Condition Does Not Allow for Special Operations**
**Observatory Will Enter Eclipse in “Cold” State**
**Heater Power Draw Will Be Heavy**
**Battery May Drop To Low Voltage During This Eclipse**
**Could Provide Bus Reset, Re-Energizing Transponder**

## Eclipse Power Analysis Outline

**Goal: Determine whether the deep eclipse in Oct 2007 could result in a reset of the spacecraft bus (with a resulting reset of the Transponder SSPC).**
- Transponder would be re-powered and operational again.
**Analysis Method:**
- Model bus loading profile as battery SOC declines during the eclipse.
**Load current based upon on-orbit data during previous eclipses.**
- Estimate current battery capacity and voltage-time discharge curve from previous on-orbit data and battery test data.
- Utilize above to determine time needed to reach Low-Voltage cutoff.
**At Low-Voltage cutoff all loads are commanded OFF.  Following eclipse exit, bus voltage will rise and all loads will be commanded ON.**
**Thermal Analysis also performed to estimate whether survival limits are broken on any spacecraft components.**

## Eclipse Power Draw Assumptions

**Battery Capacity and Voltage-Time Discharge Curve can be Estimated by Test Data **
- Only rough estimates obtained due to lack of on-orbit capacity testing and unavailability of I&T data
- Existing capacity estimated at 16.4 Ahr (to 22 Vdc)
- Battery assumed fully charged since previous eclipse
**Three Phases Of Battery Draw-Down**
- Initial state on eclipse entry
- State after survival heaters turn on at minimum temperatures
- State after battery state-of-charge (SOC) alarms trigger
**Initial Observatory State Set by 72-hour Watchdog Timeout**
- Caused by no commands accepted in past 72 hours
- Results in System Control Unit (SCU) reboot and safemode state
**Thermal State of Observatory**
- Based on observed historical events
- Rates of temperature lapse based on historical rates
**Alarm Response Conditions Based on PDU Specifications**
- Also use flight experience where available

## Eclipse Power Draw Assumptions

**Two previous eclipses were utilized to estimate power and thermal states/trend during the long Oct 2007 eclipse [~160 minutes].**
**31-Mar-2003 eclipse [~75 minutes]**
**Used to estimate initial power and thermal state upon eclipse entry, load current during first hour of eclipse and after 30% SOC safing.**
**SC was in state very similar to current state (i.e. CIDP powered OFF) due to unintended 40% SOC alarm trip.**
**8-April-2003 eclipse [~120 minutes]**
**Used to estimate equipment cool down rates and load current after Payload survival heater activation.**
**Spacecraft-sun geometry was very typical of long eclipses, good representation of October 2007**
**Spacecraft power state included CIDP ON and payload pre-warming, but otherwise fairly close to current state**
**Cool-down period was very long and uniform (from pre-warmed entering eclipse to survival limits) allowing good estimation of cool-down rates for all components of payload and spacecraft.**

## 31-Mar 2003 Events

**Observatory Placed into Unique Configuration**
**Attempted to drive Observatory as Warm As possible**
**Payload On**
**Payload Heater Controls set to Operational High Limit**
**Operations triggered by stored command right after previous eclipse.**
**Result was total current Draw Exceeding Solar Array Output (Power-negative condition)**
**Battery Discharged while in Sunlight**
**Observatory Onboard Responses Protected System**
**At 50% SOC limit, PL went to low-power mode **
**Still power-negative**
**At 40% SOC limit, CIDP (and hence PL operational heaters) powered off**
**System now Power Positive**
**Battery Recharged Completely Before Next Eclipse**
**Survival Heaters Held All Temperatures above Survival Minimums**

## Uncertainties

**Battery capacity is estimate.**
- Includes effects of aging and lower load current.
- However, estimate based on weakest cell, and linear degradation rate.
**Discharge curve is estimate.**
- Depends on age deterioration of battery and how well ground test data can model on-orbit performance.
- High confidence in plateau voltage, less confidence in location of knee.
- Slope past knee will lessen with age, but uncertain how much.
- Presence of 2nd plateau is uncertain.
**Load current is variable.**
- Exact phasing of thermostatically controlled heaters drives instantaneous current draw at any moment.
- Results in short term variations of +/- 1.5 A or more.
**Effect of lower bus voltage on current draw.**
- Heaters will draw less instantaneous current but at a higher duty cycle.
- DC-DC converters will draw more current to maintain power.
- Will be exaggerated as voltage continues to drop.
**Estimation error in temp lapse rates.**
- Time survival heaters activate is variable by +/- 10 min.

## Entry Until Survival Heater Turn-ON

**Current draw during first hour of eclipse.**
- Modeled by 31-Mar-2003 eclipse
- Transponder current draw (1.1 Amps per spec) must be subtracted.
- Payload heaters will remain off for first hour.
- True  Amp-Hour discharge deduced from PDU reported SOC
- PDU returns percent SOC based on 21 Amp-hour nameplate battery capacity
**Draw is estimated by:**
**	**** ****(Total Ahr discharge)/(Time to Survival Htrs ON) - (Transmitter Current)**
**From flight data:**
- DOD at Survival Htr turn ON = 25 % of 21 amp-hours = 5.25 amp-hours
- Time to Survival Htr turn ON = 1 hour (allowing penumbra time)
- Draw rate on 31-mar-2003 = 5.25 amps
_**Draw for first hour October 2007 is 4.15 amps**_**, estimated +/- 5%.**

## Transition to PL Survival Heaters ON

**Thermal State Prior To Eclipse Based on 31-Mar-2003 Conditions**
- Payload Equilibrium Temperatures Range From _-15 C to -20 C_
- SC Equipment Temperatures from +3 C (Battery) to -12 C (TAM)
- Transponder was +5 C, but will be colder in Oct 2007 since it is presumed to be OFF.
- Estimated Error +/- 3 C
**Decline Rates Based on Rates of 08-Apr-2003 Eclipse**
- Lapse Rate for all PL elements is between _10 and 15 C per hour_
**Survival Temperatures (-30 C) Reached in **_**One Hour**_** (+/- 10 minutes estimated)**

## Current Draw At Payload Survival

**Thermostatically controlled PL survival heaters activate -30 +/- 5 C**
**Current draw is irregular **
- Mechanical Thermostats
- Variable Phasing
**Model for this phase is deepest eclipse of 2003 season, 08-Apr-2003**
**“****Eyeball Estimate” of Average current draw is 9 +/- 1.5 Amp**
- Significant Variation
- Peaks up to 12 Amps
- True “Average” difficult to calculate.
_**Draw while survival heaters are ON is 9 Amps**_**, estimated +/- 16%**

## Battery SOC Alarms

**All Alarms activated by Calculated SOC Percentage**
- Percentages based on FSW assumed 21 Amp Hours Battery Capacity
- Calculation performed in PDU
**At 50% SOC, SCU will Power off  CIDP**
- Demonstrated 31-Mar-2003
- No response now, CIDP is already off.
**At 40% SOC, SCU will power off AST, MTS, Sun Sensor**
- Demonstrated 31-Mar-2003
- Power draw replaced by survival heaters
**At 30% SOC, SCU will halt keep-alive to PDU**
- Causes SCU reboot after 30 minutes
- Thermistor Heaters and PL survival heaters are Powered off w/no delay
- Always Occurs at 14.7 Amp-Hours discharged from Battery
**When Solar Array Power Returns System Tries to Wake Up**
- SCU Re-Booted, Alarm Sequence Re-Enabled
- System will fall through Alarms and re-execute 30% SOC actions
- Cycle continues until SOC calculated above 30%

## Current Draw after 30% SOC

**Estimate based on Minimum Current Draw in “Warm  Conditions” just before 31-Mar-2003 eclipse:**
- 2.3 Amps between Battery Heater Pulses.
- SCU Power Use
**0.7 Amps **
**Powers off after 30 minutes**
- No Transponder Power
**1.1 Amps less current**
- Result is 0.5 Amps PDU survival power
**Draw after 30% SOC is:**
- _1.2 Amps_, for first 30 minutes (PDU and SCU still ON), then
- _0.5 Amp_ (only PDU ON)
**“****Terminal Level” of draw will continue until Bus Reset (Good) or Sun Returns (Bad)**
**SC will reset to original condition (including battery recharge) before next eclipse – no cumulative effect.**
- Estimated Error +/- 0.1 Amp

## Nominal Battery Capacity Estimate

**Existing capacity estimated at 14.25 Ahr (to 22 Vdc)**
**Capacity degradation rate derived from Crane test data by calculating average capacity degradation over test period that represents 2.6 yr of on-orbit IMAGE life.  **
**Then linearly extrapolate the degradation rate to the IMAGE battery age of 7.5 years (at time of next deep eclipse - Oct 07).**
**Assume original capacity is the capacity measurement of the flight battery when delivered for I&T (26.4 Ahr).**
**Corrections for test data load vs. on-orbit load.**
**Test data was taken using an 11 A load.**
**Average on-orbit discharge rate during the eclipse will be ~6.3 A.**
**Rule of thumb is that capacity gain is ~15% per 5 A reduction in discharge rate.**
_**Adjusted Estimate is 16.4 Ahr.**_

## Battery Discharge Profile Estimate

**Rough modeling of discharge curve obtained using Crane test data.**
**No on-orbit capacity testing performed and unavailability of I&T data. **
**Step 1: Use the cycle 520 discharge curve as idealized model of on-orbit discharge curve.**
**Use the cycle 520 curve (2.6 yr) because it represents the test battery state closest to the Oct 07 on-orbit age that is available.**
**Scale the rightmost part of the curve (knee and 22 Vdc capacity point) to the left to account for a reduced capacity at 7.5 years of equivalent on-orbit life and lower load current.**
**Use capacity and degradation rate calculated earlier (16.4 Ahr, 1.62 Ahr/yr).**
**Initial drop to ~26V plateau and plateau level left as is.**
**Result is idealized discharge curve adjusted for average on-orbit load current (6.3 A) and battery age (7.5 year).**
**Step 2: Scale the ideal discharge curve for on-orbit voltage and current profiles.**
**Voltage is raised by a factor of 22.**
**Test data voltage is on a cell basis.  IMAGE battery consists of 22 cells in series.**
**Amp-Hour measurements are converted to on-orbit time using the current profile of the expected deep eclipse in Oct 2007.**
**Result is idealized discharge curve scaled for on-orbit load current profile and battery age.**

## Eclipse Discharge SummaryNominal Load Estimate

**Eclipse Discharge Summary****Nominal Load Estimate**

## Eclipse Discharge SummaryBest Case Load Estimate

## PDU Low-Voltage Reset

**At a Pre-Set Minimum Bus Voltage Level, PDU Reset Occurs**
**Assumption has been 21 Vdc, consistent with PDU FSW requirements**
**However, the same requirements also indicates 24 Vdc as the reset**
**Strong Circumstantial Evidence (but not direct observation) from Eclipse April 8-9, 2003 supports this position.**
**Reset level is not available in telemetry so cannot confirm directly**
**Low-Voltage Reset Provides Recovery Path**
**Battery Voltage Decays to Reset Point **
**PDU Turns Off All Loads (Including SSPC to Transponder)**
**Battery Voltage Decays to Interpoint DC-DC Threshold (~14 VDC)**
**Bus Voltage Rises to Interpoint Threshold**
**PDU Power Reapplied**
**SSPC’s cycled OFF-ON to reapply power to all equipment**
**Bus Voltage Rises to Reset Point + 1 V (intentional Hysteresis)**
**PDU operates as in breakwire detection sequence**

## Post Eclipse Reset and Recovery

**Thermally, observatory will survive eclipse with no damage.**
**All Observatory Elements have 10 C Margin between “Survival Minimum” and Lowest Test Temperature**
**No damage to observatory for at least one hour after heaters off.**
**Neither 30% SOC alarm nor Reset likely before 90 minutes of Eclipse**
**Recovery Plan Presented by Rick Burley**

## Conclusion:

**Bus Voltage drop to 21 Vdc unlikely to occur near eclipse end.**
**Time to reach 30% Calculated SOC is Approximately 134 minutes**** ****vs. eclipse duration of 160 minutes.**
**Discharge curve of battery requires some optimistic assumptions to reach 21 Vdc by this point.**
**However, still potential for reset near end of eclipse, prior to 30% SOC.**
**Strong circumstantial Evidence Indicates that Reset Level is 24 Vdc**
**Flight data from 08-Apr-2003 Best explained by 24 Vdc Reset**
**Large variability in load current at low bus voltages may induce a momentary voltage sag that would force a reset.**
**Current Draw will highly variable: 9 +/- 1.5 Amps.**
**PDU only requires one bus voltage reading at 21 Vdc to initiate reset.  **
**There is apparently no filtering of sensed voltage reading for this reset test.**

## RECOVERY PLANNING

**Rick Burley, IMAGE Mission Director**

## MOMS TO-164 SOW modified to move IMAGE to ‘skeleton operations’ from May 1, 2006 to Sept 30, 2007.
Supports chance of possible spacecraft revival during deep eclipse of Oct 2007.
IMAGE Ops Team will stay intact but have already begun other assignments.
If successful revival then current team will restart operations.
DSN passes will stop after successful AMOS observations in support of FRB.
IMAGE will begin scheduling of DSN passes after every eclipse during 2 week period between middle and end of October 2007.
We will not schedule DSN passes after October 2007 unless IMAGE revives.

- Supports chance of possible spacecraft revival during deep eclipse of Oct 2007.
- IMAGE Ops Team will stay intact but have already begun other assignments.
- If successful revival then current team will restart operations.
- DSN passes will stop after successful AMOS observations in support of FRB.
- IMAGE will begin scheduling of DSN passes after every eclipse during 2 week period between middle and end of October 2007.
- We will not schedule DSN passes after October 2007 unless IMAGE revives.

**Recovery Plan (1 of 2)**

## If IMAGE RF signal is detected we will operate as we did in April 2003 mega-eclipse season, using stored commands to drive temperatures to survival-max between eclipses, and survival-min during eclipses.
There is nothing we can do to prevent a recurrence of this anomaly.
PDU s/w rejects all commands to Transponder SSPC by design.
PDU s/w is not patchable.
 If IMAGE comes back online, we will ‘re-commission’ IMAGE s/c bus and payload after the eclipse season ends.
Payload and their HVs brought back up slowly, step by step, comparing their measurements to those before the anomaly.
Not really much re-commissioning can be done for the s/c bus - other than taking the opportunity to reorient the spin-axis back to orbit normal - in order to minimize the gravity-gradient torque.
Some safing limit adjustments will be considered.

**There is nothing we can do to prevent a recurrence of this anomaly.**
- PDU s/w rejects all commands to Transponder SSPC by design.
- PDU s/w is not patchable.
** ****If IMAGE comes back online, we will ‘re-commission’ IMAGE s/c bus and payload after the eclipse season ends.**
- Payload and their HVs brought back up slowly, step by step, comparing their measurements to those before the anomaly.
- Not really much re-commissioning can be done for the s/c bus - other than taking the opportunity to reorient the spin-axis back to orbit normal - in order to minimize the gravity-gradient torque.
- Some safing limit adjustments will be considered.

**Recovery Plan (2 of 2)**

**Notes:**
Need to discuss safing limits.  With a lower battery capacity, the SOC based Safing limits are not triggering when they are supposed to (now are way late).  So, ideally, we’d like to update the limits to reflect the new capacity number.  However, we can’t due to the fact that there is no FSW patch capability.  Limits were never designed to be updated anyway due to shortness of mission.

- Jim La/Code 444

## Lesson #1: The Transponder Receiver should have redundancy built into its power switching or the sensed operational status – even if the mission is designed as single string throughout.

Hardwiring the receiver power is typical Industry wide practice.  There is a currently proposed GSFC “golden rule” that addresses that the receiver should be permanently connected to the bus with only the transmitter switched.  

- Hardwiring the receiver power is typical Industry wide practice.  There is a currently proposed GSFC “golden rule” that addresses that the receiver should be permanently connected to the bus with only the transmitter switched.

**Lessons Learned**

## Lesson #2: Part anomaly alert process should be more inclusive to operations personnel.  If it could include alerts to missions that are using the part, then some preventive operational mitigations might be put into effect.

Wider distribution of NASA Alerts would allow better dissemination of part anomaly data.
Distribution should include Mission Directors of operational missions and contractors working on NASA missions.
Current distribution is mostly limited to hardware development personnel.

- Wider distribution of NASA Alerts would allow better dissemination of part anomaly data.
- Distribution should include Mission Directors of operational missions and contractors working on NASA missions.
- Current distribution is mostly limited to hardware development personnel.

**Lessons Learned**

## Lesson #3: Complete & accurate as-built design documentation is essential for anomaly resolution.  As-built documentation should include a searchable parts list.

As built parts lists are often not delivered, even though specified as a contract deliverable.  
Should be searchable and in standard format.
Enforcement of delivery should be pursued more aggressively.

Lesson #4:  Safing limits & operational procedures related to battery SOC should be adjusted to account for battery degradation as the mission progresses past the nominal lifetime.

Adjustments should be assessed and implemented, if possible, to preserve safing margins.

- As built parts lists are often not delivered, even though specified as a contract deliverable.
**Should be searchable and in standard format.**
**Enforcement of delivery should be pursued more aggressively.**
**Lesson #4:  Safing limits & operational procedures related to battery SOC should be adjusted to account for battery degradation as the mission progresses past the nominal lifetime.**
- Adjustments should be assessed and implemented, if possible, to preserve safing margins.

**Lessons Learned**

- Michael Prior
- HST Deputy Ops Manager &
- IMAGE FRB Chairman/Code 581

## Findings and Conclusion	

**It is likely IMAGE became unable to continue routine communications due to an ‘instant trip’ of the SSPC supplying power to the Transponder.**
- Several other possible, but very unlikely, causes exist that cannot be completely eliminated.
- A recurrence of the anomaly is possible and cannot be prevented.
**The previous anomaly history of IMAGE was not a harbinger of the current failure.  However, the anomaly history of EO-1 and WMAP were.**
**The operational response to the anomaly was timely, appropriate, and complete.**
**It is unlikely that the IMAGE mission can be revived.**
- The Oct 2007 eclipse season *may* permit a Transponder SSPC reset, but this is not certain given that the reset level may really be 24 Vdc.
- If revival occurs, the mission should be able to continue as before with no limitations.

## Forward Plan	

**Complete AMOS observations.**
- If the command test is successful then Transmitter is likely cause.
- Use cmd capability to force a reset that may allow Transmitter to revive.
- If unsuccessful, then neither the Transmitter nor Receiver can be isolated as the cause.
**IMAGE operations will be put into a standby mode to await the Oct 2007 eclipse season.**
**The IMAGE End of Mission Plan is currently in review, and will be executed, if appropriate, following the October 2007 deep eclipse.**
**Final FRB report will be completed by the end May 2006.**

## End of Mission Procedures

**Disposal**
- Only option is to leave the spacecraft in the current orbit
- Technically does not meet the guidelines, but is acceptable
**No option available (no propulsion system)**
**Highly eccentric orbit should not affect other missions**
**Passivation**
- Nominal mission procedures
**Set battery charge rate to low, and retain loads on power bus**
**Disable spacecraft transmitter**
**Disable RPI transmitter**
**Investigate ways to disable self-revival after eclipses**
- Current situation procedures
**Send commands to accomplish above procedures (except self-revival)**
**Commands will most likely be unsuccessful, however**
**End of Mission Plan**
- Draft plan is in review at this time