Reloading the Operating System on Galileo's PC

An operation unprecedented in the history of spacecraft flight operations was executed by Project Galileo in February of this year: the spacecraft's operating system was completely reprogrammed while in flight. The software transplant, Phase 1 of a two-part effort, was required to compensate for the failure of the high-gain antenna (HGA) to open, jeopardizing the accomplishment of many critical mission objectives.

Shortly after the April 1991 HGA deploy failure, Les Deutsch of the Tracking and Data Acquisition (TDA) Technology Office was tasked with looking for a way to perform the Galileo mission, using the low-gain antenna for communications. The conceptual applications of ongoing coding and compression research were explored quietly through the summer, leading to a short options study led by Deutsch in the fall--with stunning results. Next, Jim Marr, representing the Project, and Deutsch assembled a team of approximately 45 members who spent 2-1/2 months developing an alternate method of returning data from the 10-satellite orbital tour if the HGA could not be opened. After this concept (which will be implemented as Phase 2 in March 1996) was approved by NASA, a second study, with a team of 12 members led by Wayne Kohl of the Avionics Systems and Technology Division at JPL, was initiated in 1992 to determine how best to ensure the return of Probe data. Recommendations from that second study were successfully implemented by the just accomplished Phase 1 inflight load (IFL) of new software.

In March 1993, having exhausted all efforts to open the HGA and, in accordance with the agreements reached with NASA in April 1992, full-scale development of Phase 1 and Phase 2 flight and ground software began. Project Galileo formed a Systems Development Office led by Jim Marr, and TDA established a Galileo S-Band (GSB) development task led by Joe Statman. For Phase 1, two major subsystems were affected: the Command and Data Subsystem (CDS), which is Galileo's central computer, and the Attitude and Articulation Control System (AACS), which orients the spacecraft, points the scan platform, and controls the propulsion subsystem. The CDS and AACS teams began writing new flight software (FSW) for the two subsystems while the Ground Data System (GDS) team made supporting changes in the uplink command and downlink telemetry systems. In August 1994, the memory cells in the CDS that had not been in regular use were tested to verify their functionality, and the AACS's redundant (back-up) memory was tested. Then the Orbiter Engineering Team (OET) made up command packages, with support from the Sequence Team, and tested them on the Galileo testbed. On January 30, the Phase 1 reprogramming was begun by the Galileo Mission Operations and Engineering (MO&E) team.

Loading the new software involved many risky challenges. To accomplish the reloading, Galileo's full redundancy had to be temporarily disabled, on multiple occasions. Additionally, safing routines had to be executed during the reload process. The CDS had been designed with two redundant halves, or "strings," each of which has a primary and an extended (backup) memory. The CDS normally operates from the primary memory on one string with the second string acting from its primary memory as an active backup. The AACS also has two redundant strings, but operates from one string, with the second string in a nonactive backup mode.

Taking advantage of this redundancy, the Phase 1 FSW for the CDS was loaded into the extended memory of both strings, while both strings used their primary memories to control the spacecraft. Redundancy was temporarily disabled and one string was configured to operate out of its newly loaded extended memory, while the primary memory was tested on that string, and then new software was copied into it. That string was then reconfigured to operate out of its primary memory again. This process was repeated for the second string, after which full redundancy was reestablished and normal operations continued with the new FSW. The AACS memory was then tested and reloaded, one string at a time, while the other string remained active. Although the rewritten AACS FSW was only a small percentage of the total code, a total recompile was necessary that required reloading all the code.

The new FSW compensates for the fact that without the HGA, Probe data cannot be transmitted back to Earth in real time. The Data Memory Subsystem (DMS) tape recorder was to have been used as a backup to the real-time link, but is now the primary method of data acquisition. The new FSW enables the CDS extended memory to be used for backup data storage through the primary Probe mission requirement of reaching 10 bars, or the first 39 minutes of the descent. Ensuring this redundancy was a key objective of the Phase 1 effort. In addition, because the tape recorder can only be connected to one CDS string at a time, the new FSW was written to autonomously switch the recorder to the other string if the first string were to go down.

In the AACS, the new FSW solves several problems that emerged after launch. First, it provides new levels of fault protection for relay link antenna pointing. Because the star scanner may not be reliable in Jupiter's intense radiation field, the new FSW provides new backup methods of roll (clock) reference. Each backup method is more robust than the previous method, although somewhat less accurate. However, each method provides adequate roll control, and project designers are confident that critical mission events will be accomplished.

In March 1995, the new Phase 1 FSW successfully carried out its first task onboard the spacecraft-- checking out the Probe.

Having achieved the goals of Phase 1, Systems Development team members are now in the home stretch of Phase 2, in which vastly more extensive changes will be made to CDS FSW and to the ground system software and hardware, plus changes to AACS FSW and that of 8 of the 11 science instruments. These changes, due to be sent to the spacecraft in March 1996, will carry the Galileo mission through to its completion in December 1997.