Fault protection design for unmanned interplanetary spacecraft

The difficulties encountered in designing a redundancy management system are discussed and strategies for minimizing the cost and schedule impacts associated with fault protection are provided. Specific examples from the Magellan project are used with emphasis placed on control system fault protection. The major problem areas are the following: (1) the interaction between two semiindependent fault protection systems, (2) the response to faults which are detected by monitoring variables with long time constants, and (3) the design of the 'action scheduler'.