The European Space Agency (ESA) is breathing easier after communications with Jupiter Icy Moons Explorer (Juice) were restored – the spacecraft is currently barreling toward Venus for a gravity-assist flyby on August 31.
The probe, which was launched in April 2023, began giving controllers the silent treatment when ESA’s deep space antenna in Cebreros, Spain, failed to contact the spacecraft at the expected time of 0450 CEST on July 16. The ground station appeared to be functioning properly, and when ESA’s New Norcia station also failed to make contact, controllers realized the problem was on Juice itself.
So what had happened? If there had been a major failure, Juice might have gone into survival mode and entered a slow spin, sweeping its antenna across the Earth once per hour. However, there wasn’t a peep out of the spacecraft.
“Losing contact with a spacecraft is one of the most serious scenarios we can face,” said Angela Dietz, Juice Spacecraft Operations Manager. “With no telemetry, it is much more difficult to diagnose and resolve the root cause of an issue.”
Perhaps the antenna had somehow become misaligned, or maybe there had been a failure in the signal transmitter or amplifier. Teams scrambled to find a solution – with the Venus flyby looming, simply waiting 14 days for the next automatic spacecraft reset wasn’t an option. Instead, the team attempted to send commands blindly into space, where Juice was expected to be, hoping that a backup antenna might receive them.
It took over 20 hours – each command takes 11 minutes to reach the spacecraft, another 11 minutes for a response to arrive. Six attempts to point the medium-gain antenna back toward Earth were unsuccessful. However, a command to switch on the signal amplifier that boosts the strength of the signal that Juice sends toward Earth did work, and contact was reestablished.
The spacecraft was healthy, but the question of what happened remained. As it transpired, it was one of those things software engineers are all too familiar with: a combination of events happening at precisely the wrong time.
The issue was with a timer used by the software on board the spacecraft to turn the signal amplifier on and off. It constantly counts up and restarts from zero once every six months.
Software engineers will see where this is going.
If the function to turn on the amplifier happens to be using the timer at around the moment the timer restarts, the amplifier remains switched off, and Juice’s signal is too weak to be detected from Earth.
Dietz told The Register: “The downlink amplifier is controlled by an onboard function (OBCP) that uses an internal timer for wait/sleep statements. If called near the wrap-around point for a duration extending beyond it, the timer fails to wake the function, leaving the amplifier permanently off. This exact scenario had occurred.
“The OBCP itself is used to schedule the transmitter amplifier on operations. We need this additional logic on-board to avoid radiation of the downlink through forbidden zones – there are scientific sensors in certain parts of the field of view of the antenna.”
The team is pondering how to fix the issue. Dietz told us: “Possible mitigations of this anomaly would be for example, a regular controlled reset of this timer, or replacing this timer with a different one, which wraps around only after >100 years.
“We might require a spacecraft software change (which is a complex activity), though other options would be easier.”
Fortunately, there are 15 months until the timer wraparound occurs again, by which time Juice will have completed its next flyby of Earth on its trajectory to Jupiter. ®
Source link
