scope:

Abstract:

In-flight the EPOXI spacecraft exhibited a safe mode instability after a portion of the torque distribution was assigned to a reaction wheel that had been powered down. It was determined that safing assumes that all wheels are operational and does not check the power state of each wheel. It would not significantly increase flight software complexity for safing to check the status of each wheel. Safing designers should also consider avoiding reliance on a software flag to activate a set of RWAs, disabling auxiliary controllers while in safe mode, avoiding autonomous switching from thruster to RWA control, disabling unnecessary attitude control performance enhancement features while in safe mode, and scrutinizing new features that may have unintended consequences when added to heritage systems.