report

Flight Software Modes and FDIR Policy

Overall verdict: PASS
Design signature: 837095c6390ee9493e66d5de27386b78d597bbc34ba6eebbff3692c10685768f
Architecture: deterministic mode manager with autonomous fault containment, cold-lane computer recovery, and ground-authorized safe-mode exit

Operating modes

Mode	Objective	Entry authority	Power limit	Pointing state	Thermal mode
`boot`	Establish one healthy flight-computer lane, validate boot images, and inhibit deployment and propulsion outputs.	`autonomous_reset`	`120.0 W`	`uncontrolled_then_magnetorquer_detumble`	`survival_hold`
`commissioning`	Check out power, thermal, attitude, command, telemetry, and redundant avionics before deployment is enabled.	`autonomous_sequence`	`240.0 W`	`coarse_sun_acquisition`	`survival_hold`
`deployment`	Execute the released deployment timeline under inhibit, continuity, motion, and capture monitoring.	`ground_command`	`300.0 W`	`coarse_sun_hold`	`survival_hold`
`standby`	Maintain a thermally safe, commandable observatory while awaiting scheduled science or communications activity.	`autonomous_or_ground`	`130.0 W`	`coarse_sun_hold`	`operational_setpoint`
`science`	Hold fine inertial pointing, acquire detector integrations, and commit validated products to redundant recording.	`time_tagged_ground_command`	`500.0 W`	`fine_inertial_pointing`	`operational_setpoint`
`downlink`	Return recorder products over X-band while preserving S-band command and telemetry reception.	`scheduled_ground_contact`	`480.0 W`	`ground_contact_tracking`	`operational_setpoint`
`momentum_dump`	Suspend imaging and unload reaction-wheel momentum with the magnetorquer triad.	`autonomous_fdir`	`190.0 W`	`coarse_inertial_hold`	`operational_setpoint`
`safe`	Shed non-essential loads, maintain detector survival heat, acquire the Sun, detumble, and preserve S-band commandability.	`autonomous_fdir_or_ground`	`110.0 W`	`bdot_detumble_then_coarse_sun_hold`	`survival_hold`

Mode transitions

From	To	Trigger	Authority	Guard
`boot`	`commissioning`	`boot_self_test_pass`	`autonomous`	one flight-computer lane healthy and essential telemetry available
`commissioning`	`deployment`	`deployment_enable_command`	`ground_command`	bus checkout passed and all deployment inhibits verified
`deployment`	`standby`	`deployment_completion_gate_pass`	`autonomous`	retained captures confirmed and mechanism power isolated
`standby`	`science`	`science_activity_due`	`time_tagged_command`	fine-pointing and thermal health gates passed
`science`	`standby`	`science_window_complete`	`autonomous`	detector products committed to mass memory
`standby`	`downlink`	`ground_contact_acquired`	`time_tagged_command`	X-band link and recorder read path healthy
`downlink`	`standby`	`contact_complete`	`autonomous`	recorder bookkeeping committed
`science`	`momentum_dump`	`wheel_momentum_high`	`autonomous`	imaging integration safely terminated
`momentum_dump`	`science`	`wheel_momentum_recovered`	`autonomous`	fine-pointing reacquired within science allocation
`boot`	`safe`	`critical_fdir_trip`	`autonomous`	boot timeout, invalid image, or essential telemetry loss
`commissioning`	`safe`	`critical_fdir_trip`	`autonomous`	power, thermal, attitude, or computer fault persists
`deployment`	`safe`	`critical_fdir_trip`	`autonomous`	deployment sequence halted with release outputs inhibited
`standby`	`safe`	`critical_fdir_trip`	`autonomous`	power, thermal, attitude, or computer fault persists
`science`	`safe`	`critical_fdir_trip`	`autonomous`	detector acquisition terminated and recorder write closed
`downlink`	`safe`	`critical_fdir_trip`	`autonomous`	X-band transmitter inhibited before load shedding
`momentum_dump`	`safe`	`critical_fdir_trip`	`autonomous`	torque rods de-energized before fault containment
`safe`	`standby`	`ground_recovery_command`	`ground_command`	fault isolated, health gate passed, and autonomous retrip inhibit cleared

FDIR monitors

Monitor	Fault class	Sources	Effectors	Recovery target	Detection latency
`flight_computer_watchdog`	`flight_computer`	`flight_computer_pair`	`flight_computer_pair, pcdu, flight_software_mode_manager`	`safe` then `safe`	`2.0 s`
`bus_undervoltage`	`power`	`pcdu, battery`	`pcdu, battery, flight_software_mode_manager`	`safe` then `safe`	`1.0 s`
`detector_thermal_limit`	`thermal`	`detector_control, detector_mount_guard, focal_plane_monitor`	`detector_heater_primary, detector_heater_redundant, pcdu, flight_software_mode_manager`	`safe` then `safe`	`30.0 s`
`attitude_solution_loss`	`attitude`	`star_tracker_pair, imu_pair, coarse_sun_sensor_ring, magnetometer_pair`	`reaction_wheel_cluster, magnetorquer_triad, flight_software_mode_manager`	`safe` then `safe`	`5.0 s`
`wheel_momentum_high`	`momentum`	`reaction_wheel_cluster, magnetometer_pair`	`reaction_wheel_cluster, magnetorquer_triad, flight_software_mode_manager`	`momentum_dump` then `safe`	`3.0 s`
`command_link_loss`	`communications`	`s_band_transceiver_pair, rf_distribution_pair, s_band_low_gain_antenna_set`	`x_band_transponder_pair, s_band_transceiver_pair, rf_distribution_pair, flight_software_mode_manager`	`standby` then `safe`	`900.0 s`
`recorder_uncorrectable_error`	`mass_memory`	`solid_state_recorder_pair, spacewire_router_pair`	`solid_state_recorder_pair, spacewire_router_pair, flight_software_mode_manager`	`standby` then `safe`	`10.0 s`

Flight Computer Watchdog

Detection: Active flight-computer heartbeat absent or boot image integrity check fails.
Isolation: Cross-strapped lane-health discretes distinguish active-lane failure from shared power loss.
Recovery: Power-cycle the active lane once, switch to the cold spare on recurrence, and enter safe mode.

Bus Undervoltage

Detection: Regulated-bus undervoltage or battery-contactor disagreement persists through the debounce window.
Isolation: PCDU channel telemetry and independent battery contactor states identify the affected source or load branch.
Recovery: Shed non-essential channels in priority order, isolate the failed battery branch, and enter safe mode.

Detector Thermal Limit

Detection: Voted detector-control and mount-guard temperatures cross the survival or over-temperature limits.
Isolation: Compare the primary control, mount guard, and focal-plane monitor channels to reject a single implausible sensor.
Recovery: Command survival hold, enable the redundant heater if required, shed detector electronics, and enter safe mode.

Attitude Solution Loss

Detection: Star-tracker invalidity, IMU propagation timeout, or coarse-Sun disagreement removes a valid attitude solution.
Isolation: Cross-compare both star trackers and IMUs against the coarse-Sun ring and magnetometer pair.
Recovery: Stop fine-pointing, disable reaction-wheel torque commands, detumble with magnetorquers, and enter safe mode.

Wheel Momentum High

Detection: Any wheel exceeds the declared high-water momentum threshold for three consecutive samples.
Isolation: Compare individual wheel telemetry with commanded body torque and magnetometer validity.
Recovery: Suspend imaging and enter momentum-dump mode; enter safe mode if the dump timeout expires.

Command Link Loss

Detection: S-band receiver lock and expected-contact command frames are both absent beyond the scheduled contact grace period.
Isolation: Compare both transceiver lanes, RF distribution paths, and four low-gain antenna receive metrics.
Recovery: End X-band transmission, return to standby, retain the S-band receiver, and escalate to safe mode on a concurrent critical fault.

Recorder Uncorrectable Error

Detection: Recorder EDAC reports an uncorrectable page or the active recorder stops acknowledging writes.
Isolation: Replay the write to the cold recorder lane and compare recorder and router health telemetry.
Recovery: Close the affected product, switch recorder lanes, return to standby, and enter safe mode if both lanes fail.

Safe-mode resource state

Continuous power: 100.4 W against 110.0 W; margin 9.6 W.
Worst-case eclipse energy: 64.3 Wh against one-module usable 477.8 Wh.
Thermal: survival_hold at 91.0 K, using detector_control, detector_mount_guard, focal_plane_monitor and detector_heater_primary, detector_heater_redundant.
Pointing: bdot_detumble_then_coarse_sun_acquisition using coarse_sun_sensor_ring, magnetometer_pair and magnetorquer_triad.
Commandability: command_uplink uplink and telemetry_downlink downlink through rf_distribution_pair, s_band_low_gain_antenna_set, s_band_transceiver_pair.

Safe-mode load ledger

Load	Released source	Demand
`pcdu_housekeeping`	`power.pcdu.housekeeping_power_w`	`18.0 W`
`active_flight_computer`	`cdh.hardware.flight_computer_pair.power_w_each`	`22.0 W`
`cdh_controller_overhead`	`cdh.controller_overhead_power_w`	`2.0 W`
`adcs_controller_overhead`	`adcs.controller_overhead_power_w`	`4.0 W`
`coarse_sun_sensors`	`adcs.sensors.coarse_sun_sensor_ring.power_w`	`2.4 W`
`magnetometers`	`adcs.sensors.magnetometer_pair.power_w`	`1.0 W`
`magnetorquer_detumble`	`adcs.actuators.magnetorquer_triad.power_w`	`14.0 W`
`detector_survival_heaters`	`thermal_model.robustness_sweep.max_detector_heater_w`	`7.0 W`
`s_band_command_telemetry`	`communications.hardware.s_band_transceiver_pair.power_w_each`	`18.0 W`
`rf_distribution`	`communications.hardware.rf_distribution_pair.power_w_each`	`8.0 W`
`communications_controller`	`communications.controller_overhead_power_w`	`4.0 W`

Checks

Check	Result
`fdir_upstream_subsystem_gates_pass`	PASS
`flight_software_configuration_block_present`	PASS
`flight_software_modes_complete`	PASS
`flight_software_transition_graph_closes`	PASS
`fdir_monitor_coverage_complete`	PASS
`fdir_hardware_responsibility_complete`	PASS
`critical_faults_enter_safe_mode`	PASS
`safe_mode_power_state_closes`	PASS
`safe_mode_single_battery_eclipse_closes`	PASS
`safe_mode_thermal_survival_closes`	PASS
`safe_mode_pointing_state_closes`	PASS
`safe_mode_command_telemetry_available`	PASS