Validation of Fault-Tolerant Plans for Europa Clipper

The Europa Clipper mission will explore that icy moon in a series of brief flybys through the Jovian radiation belts. A single event upset in the spacecraft flight computer during these critical scientific periods could jeopardize the success of the mission. Rather than safing and awaiting operator intervention, the Clipper mission envisions limited onboard autonomy that can restore spacecraft state sufficiently to resume the encounter observation plan as rapidly as possible. The contingency plan is contained in an Activity Restart Timeline (ART) that is transmitted in parallel with the nominal plan, which must be co-validated jointly against all spacecraft state and resource constraints amid unpredictable fault timing. A prototype validation tool was built that leverages declarative spacecraft models and automated search techniques to find such potential inconsistencies in the unified contingent mission plan. Early validation results within motivating scenarios are presented.