PDS_VERSION_ID = PDS3 RECORD_TYPE = STREAM OBJECT = TEXT PUBLICATION_DATE = 2000-05-09 NOTE = "SAFING.TXT describes spacecraft safing events." END_OBJECT = TEXT END Spacecraft Safing Summary Throughout the mission there have been a number of occasions when the spacecraft detected a fault condition onboard and configured itself to a safe state. At that time, all onboard sequences are cancelled, and a number of science instruments are powered off. The following table lists the time of these safing events, which stored sequence was aborted, and the reason that the spacecraft entered its fault protection routines. The times of the events have been extracted from different sources. Some times are known exactly and others have uncertainties of up to 5 minutes. The most uncertain times are indicated with an *. Date SCET (UTC) SEQ Cause of safing 1990-01-15 90-015/22:52* EV-5 star scanner calibration 1991-03-26 91-085/13:31:18 VE-14 B-string CDS bus reset 1991-05-03 91-123/05:26 n/a A-string CDS bus reset 1991-07-20 91-201/02:09:00 n/a A_string CDS bus reset 1993-06-10 93-161/16:53:05 EJ-1 A-string CDS bus reset 1993-06-17 93-168/18:22:04 n/a A-string CDS bus reset 1993-07-10 93-191/20:16:58 EJ-2 A-string CDS bus reset 1993-07-12 93-193/01:37* n/a A-string CDS bus reset 1993-08-11 93-223/22:04:40 EJ-2' A-string CDS bus reset 1993-09-24 93-267/14:14:54 EJ-3 A-string CDS bus reset 1994-09-14 94-257/03:10:51 EJ-7B DMSMRO memory failure 1994-09-16 94-259/16:38* n/a CAP privileged error 1995-02-04 95-035/17:44:39 n/a Phase 1 In-Flight Load-planned 1996-01-05 96-005/21:51:12 J0C-A SITURN cmd constr. violation 1996-05-18 96-139/01:26* n/a Phase 2 In-Flight Load-planned 1996-08-24 96-237/15:30:32 G01-C timing overrun from DACs 1997-12-22 97-356/16:52* E12BHG AACS Anomaly 1998-05-28 98-148/20:21:26 E14BGD Safing during OTM-47 1998-07-20 98-201/17:35:46 E16AKE Despun BUS POR 1998-11-22 98-326/05:24:13 E18AFE Simultaneous 2 string CDS bus reset two resets: 98-326/05:24:13.102 and 98-327/01:29* 1998-12-09 98-343/17:05:10 E18BFE Sequence stopped by B18T24 RBS 1999-02-01 99-032/05:41:33 E19AHC SUNACQ Failure 1999-10-10 99-283/09:17:06 I24AGE B-String CDS bus reset 1999-11-26 99-330/22:00:02 I25ADF B-String code error in box 5 start ADD 2000-02-24 00-055/12:00:13 I27ADC A&B string CDS bus reset 2002-01-17 02-017/13:41:09 I33AFE A-string CDS bus reset (parity error) 2002-02-16 02-047/20:51:00 I33BED A-string CDS bus reset 2002-10-02 02-275/03:41:22 I33EDE Commanding Error 2002-11-05 02-309/06:35:36 A34AHG Radiation Failure The most common cause of spacecraft safing was from a CDS bus reset of either the A-string or B-string. It has been determined by analysis that there has been current leakage somewhere in the spacecraft power bus, and that the resulting bus imbalances are most likely caused by brush debris forming high- resistance leakage paths across the brush armatures in the spin bearing assembly. These paths are formed and then blown open before the resistance becomes low enough to permit significant current flow. In some cases the brush was lifted briefing while debris paths were causing power to touch the brush and this tripped a reset signal in the CDS. Onboard fault protection safes the spacecraft when the reset trips [ONEIL1991]. No damage has occurred on the spacecraft as a result of these trips, but the spacecraft operations are disrupted until the onboard sequences and spacecraft state can be restored from the ground. On September 13, 1994 a memory cell in the CDS failed during the playback of Shoemaker-Levy 9 recorded data and resulted in spacecraft safing to be entered twice. After 12 days the spacecraft was reconfigured back to normal operations. The failed memory cell was located in a bulk storage (DBUM-1A) module of the CDS, and was only used during tape recorder/memory readout playbacks and other short term storage of data (ONEIL1995). Following the successful insertion into Jupiter orbit in December 1995, a spacecraft turn was attempted on January 5, 1996. The spacecraft was in a non-standard configuration following the JOI maneuver which resulted in an incompatibility between the turn design and the spacecraft state. The spacecraft entered safing, but was recovered shortly afterwards. On August 24, 1996 the spacecraft went into safing due to a timing overrun condition in the CDS, ending any further data return from the G1 encounter. The timing overrun was traced to the transmission of 4 Delayed Action Commands which stressed the limits of the CDS running the new Phase 2 flight software. By September 1,the spacecraft had been returned to normal operations and the G2 encounter sequence began on schedule (ONEIL1996). Twice during the mission, during the loading of new flight software for Phase 1 and Phase 2, the spacecraft was purposely commanded to trigger the safing response in order to put all subsystems in a known state prior to the load. During the extended mission five of the anomalies were caused by CDS bus resets that were nominally handled with software changes implemented previously.I33EDE where the spacecraft entered safing on October 2, 2002 was due to commanding error on the ground during fault protection changes (ISA 11007). In A34A an anomaly occurred on November 5, 2002 at 06:19 UTC, when the spacecraft flew within 160 km of the surface of Amalthea. The speed of the spacecraft relative to Amalthea was approximately 18.4 kilometers per second (41,000 miles per hour), taking less than 15 seconds to pass by. Approximately 17 minutes after closest approach, the intensity of the radiation caused a failure in computer circuitry that handles timing of the events on the spacecraft. This caused the computer to switch to the CDS B-string and go into safe mode. There were also several additional faults which triggered repeated requests to place the spacecraft in safe mode. DETAILS from asrun 1998-05-28 98-148/20:21:26 E14BGD Safing during OTM-47 1998-07-20 98-201/17:35:46 E16AKE Despun BUS POR 1998-11-22 98-326/05:24:13 E18AFE Simultaneous 2 string CDS bus reset two resets: 98-326/05:24:13.102 and 98-327/01:29* 1998-12-09 98-343/17:05:10 E18BFE Sequence stopped by B18T24 RBS 1999-02-01 99-032/05:41:33 E19AHC SUNACQ Failure 1999-10-10 99-283/09:17:06 I24AGE B-String CDS bus reset 1999-11-26 99-330/22:00:02 I25ADF B-String code error in box 5 start ADD For complete details for all anomallies please see the info.txt file.