Safe mode (spacecraft)
Safe mode is an operating mode of a modern spacecraft during which all non-essential systems are shut down and only essential functions such as thermal management, radio reception and attitude control are active.
Safe mode is entered automatically upon the detection of a predefined operating condition or event that may indicate loss of control or damage to the spacecraft. Usually the trigger event is a system failure or detection of operating conditions considered dangerously out of the normal range. Cosmic rays penetrating spacecraft electrical systems can create false signals or commands and thus cause a trigger event. The central processor electronics are especially prone to such events.
The process of entering safe mode, sometimes referred to as safing, involves a number of immediate physical actions taken to prevent damage or complete loss. Power is removed from non-essential subsystems. Regaining attitude control, if lost, is the highest priority because it is necessary to maintain thermal balance and proper illumination of the solar panels. A tumbling or cartwheeling spacecraft can quickly roast, freeze or exhaust its battery power and be lost forever.
In safe mode
While in this mode the preservation of the spacecraft is the highest priority. Typically all non-essential systems, such as science instruments, are shut down. The spacecraft attempts to maintain orientation with respect to the Sun for illumination of solar panels and for thermal management. The spacecraft then awaits radio commands from its mission control center monitoring for signals on its low-gain omnidirectional antenna. Exactly what happens while in safe mode is dependent on the spacecraft design and its mission.
Recovery from safe mode involves reestablishing communication between the spacecraft and mission control, downloading any diagnostic data and sequencing power back on to the various subsystems to resume the mission. The recovery time can be anywhere from a few hours to days or weeks depending on the difficulty in reestablishing communications, conditions found on the spacecraft, distance to the spacecraft and the nature of the mission.
The spacecraft's ability to enter safe mode may be suppressed during periods of crucial spacecraft operations, such as during the orbit insertion rocket firing at Saturn of the Cassini spacecraft, where if a critical failure were to occur during this operation most if not all of the mission objectives would be lost anyway.
- MRO entered safe mode on August 26, 2009 for the second incident in a month, the fourth in 2009 and the eighth since launch in 2005. The spacecraft was kept in safe mode until December 8, 2009.
- Kepler entered safe mode on June 15 and again on July 3, 2009. Both cases were triggered by an on-board processor reset.
- Dawn entered safe mode due to a programming error during its February 17, 2009 Mars flyby.
- MESSENGER entered safe mode during its third flyby of Mercury on September 29, 2009.
- Cassini–Huygens download of the Iapetus flyby data was interrupted by a safing event September 10, 2007.
- New Horizons entered safe mode March 19, 2007 due to an uncorrectable memory error in the primary Command and Data Handling (C&DH) computer.
- Odyssey has broken the communications link between the Mars rovers and Earth during several sudden safing events.
Incidents resulting in spacecraft loss or near loss
- Mars Global Surveyor entered safe mode and was lost when its batteries were overheated and destroyed by incorrect solar orientation on November 2, 2006.
- SOHO entered safe mode and was nearly lost on June 25, 1998. Normal operations were eventually restored after a gap of four months.
- NEAR entered safe mode, tumbled out of control and was nearly lost during the first attempt of Eros orbit insertion on December 20, 1998.
- "Recovery of a Spacecraft from Sun-Safe Mode Using a Fanbeam Antenna" (PDF). Spacecraft and Rockets 37 (6). November–December 2000.
- "Planning for the Un-plannable: Redundancy, Fault Protection, Contingency Planning and Anomaly Response for the Mars Reconnaissance Orbiter Mission" (PDF). AIAA SPACE 2007 Conference & Exposition. 18–20 September 2007.
- Cassini Spacecraft Safing
- "SOHO Mission Interruption Preliminary Status and Background Report - July 15, 1998". Retrieved 2096-08-17.
- "The PI's Perspective: Trip Report". NASA/Johns Hopkins University/APL/New Horizons Mission. 2007-03-27. Retrieved 2009-08-05.
- "Spirit Updates 2005". NASA/JPL. Archived from the original on 2007-08-23. Retrieved 2009-08-18.
- Tariq Malik (Sat August 8, 12:32 am ET). "Powerful Mars Orbiter Switches to Backup Computer". SPACE.com. Retrieved 2009-08-18. [dead link]
- "Orbiter in Safe Mode Increases Communication Rate". NASA/JPL. August 28, 2009. Archived from the original on 2011-06-11. Retrieved 2009-08-31.
- "Spacecraft Out of Safe Mode". NASA/JPL. December 8, 2009. Archived from the original on 2011-06-11. Retrieved 2009-12-23.
- "2009 July 7 Mission Manager Update". NASA. 2009-07-07. Archived from the original on 2009-06-11. Retrieved 2009-07-08.[dead link]
- "Dawn Receives Gravity Assist from Mars". NASA/JPL. 2009-02-28. Archived from the original on 2004-10-16. Retrieved 2009-08-04.
- "MESSENGER Gains Critical Gravity Assist for Mercury Orbital Observations". MESSENGER Mission News. September 30, 2009. Retrieved 2009-09-30.
- "Spirit Updates 2006". NASA/JPL. Archived from the original on 2007-08-23. Retrieved 2009-08-18.
- "Spirit Updates 2007". NASA/JPL. Archived from the original on 2009-04-13. Retrieved 2009-08-18.
- "Report Reveals Likely Causes of Mars Spacecraft Loss" (Press release). NASA. 13 April 2007. Retrieved 2009-07-10.
- Nancy G. Leveson (2004). "The Role of Software in Spacecraft Accidents" (PDF). Spacecraft and Rockets 41 (4): 564–575. Bibcode:2004JSpRo..41..564L. doi:10.2514/1.11950.
- "The NEAR Rendezvous Burn Anomaly of December 1998" (PDF). Final Report of the NEAR Anomaly Review Board. November 1999. Retrieved 2009-08-18.
- "safing". Dictionary.com. Retrieved 2009-08-18.