Xmm-Newton's built-in watchdog is put to the test
14 April 2000
All satellites are designed to face up to unexpected circumstances. XMM-Newton, ESA's new X-ray observatory launched last December, proved the reliability of its onboard systems when the spacecraft placed itself in standby mode on 2 April.XMM-Newton entered what is formally called the "Emergency Sun Acquisition Mode" (ESAM) on Sunday 2 April when its onboard watchdog detected that something was not quite normal. As on two previous occasions, the satellite automatically responded by placing itself in a safe position with its solar panels pointing directly to the Sun to ensure continued power and its antennae towards Earth. It simultaneously alerted ground controllers. This built-in watchdog functions by constantly checking all the spacecraft attitude parameters such as its orientation, any activity of the thrusters or reaction wheels used to maneuvre the spacecraft and by comparing them with pre-set tight limits. This routine, which is part of the satellite's Attitude and Control System, is there to prevent for instance the observatory's sensitive X-ray detectors being blinded by pointing too close to the sun. It also allows the satellite to be able to survive several days without ground contact and recover without damage from what are called single-event upsets in its electronic systems that may be caused by deep space particle radiations.
Placing the satellite in this default standby mode, waiting patiently for instructions, ensures that ground controllers are able to fully appreciate the situation. There is, strictly speaking, no emergency and they can take their time to analyse the causes of the satellite's unscheduled manoeuvre.
"XMM-Newton was being manoeuvred manually at the time" explains Robert Laini, XMM-Newton Project Manager. "A command to execute a new maneuver was sent too soon after the previous one. The satellite detected that this command conflicted with previous orders received. In such circumstances it immediately stops excuting the commanded maneuvre, closes the science instruments and places itself in safe mode within minutes".
"The Mission controllers in Darmstadt immediately understood what occurred. Once the satellite had reach its safe position, they went through their check list, verified that nothing was wrong on board then initiated the recovery procedure. This recovery involves checking and reloading one by one all the computers parameters needed for normal operations and that takes 10 hours. By now XMM-Newton has resumed normal science operations."
Such incidents always come as a surprise, says Laini, but must be expected. They occur several times during the in-orbit life of any satellite. There would be, on the contrary, cause for greater concern if the satellite failed to respond automatically to an anomalous command timing. And so far XMM-Newton is responding beautifully - even when things go slightly amiss!
