Morantz, Chaz | Search NASA

NASA NTRS2022

Mars 2020 Perseverance Rover Surface Operations Commissioning Phase Overview

This paper presents work done by the Mars 2020 Project to plan, test, and execute the Mars 2020 Perseverance Rover surface operations commissioning phase. Immediately after the successful landing of Mars 2020 Perseverance rover at Jezero Crater on February 18, 2021, the rover autonomously initiated mission critical commanding necessary to transition the vehicle from a Cruise/EDL to Surface operations configuration. This began the surface operations commissioning phase, referred to as Surface Operations Transition (SOX). The objective of SOX phase is to establish vehicle health and safety and to verify that the operational characteristics of the vehicle, now operating in the Martian environment, are as-expected and safe to proceed into nominal operations. The SOX commissioning phase is organized into six logical sub-phases occurring in the following chronological order; (1) SOX1a, (2) FSW Transition, (3) SOX1b, (4) SOX2a, (5) Heli, (6) SOX2b. In total, the SOX commissioning phase was expected to take up-to 111 sols (Martian days). The Perseverance rover is an extremely complex, highly-integrated, robotic system-of-systems that requires numerous activities to incrementally and methodically verify their safe operations. This paper will discuss the development process used to plan, test, and execute the SOX commissioning phase for Mars 2020 Perseverance rover surface operations. We will discuss key challenges associated with SOX development as well as actual operations execution experience.

Koch, Justin↗

NASA NTRS2022

Validation of the Mars 2020 Fault Protection Design: Navigating the Infinity of the Off-Nominal

On July 30th 2020, the Mars 2020 mission successfully launched out of Cape Canaveral, Florida, passed through the Earth’s shadow, and began its short cruise to Mars. Less than seven months later, the Perseverance rover touched down safely in Jezero Crater to begin its ambitious mission that includes looking for signs of ancient life and collecting samples for future return to Earth. Getting to the successful landing, or “Tango Delta Nominal,” could not have been achieved without also considering the off-nominal. One of the teams supporting this ambitious mission is the fault protection (FP) team. This team is tasked with assessing the various failures, or faults, that could prevent mission success and with ensuring that the autonomous behaviors built into the software and hardware can detect faults and recover the vehicle to a safe state. As part of its charter, the FP team designed a test campaign to provide confidence in the system’s robustness to off-nominal scenarios across all of Mars 2020’s mission phases. The greatest challenge associated with designing such a validation campaign was reducing the infinite number of anomalous scenarios into a finite test suite. In addition, the tests needed to be executed efficiently in order to utilize the team’s limited test venue access, but still needed to maintain a level of rigor that guaranteed confidence in the test outcomes. Given that each test scenario generated massive amounts of data, the team also developed methods for quickly ascertaining whether the autonomous fault protection behaviors maintained vehicle safety in the presence of an anomaly. This paper summarizes the processes that the Mars 2020 fault protection team employed to execute its off-nominal validation campaign. It captures both the methods of generating a suite of off-nominal tests, as well as reducing it to a subset that can be realistically executed within schedule and resource constraints. It also describes the various processes and philosophies that the team utilized to execute the tests efficiently, including creating a standardized procedure template, keeping the test cases modular so that they could be easily interchanged, and capturing common fault injections in a change-controlled database. Finally, it will describe the tools and processes for assessing the test data, focusing in particular on a tool that evaluated vehicle state using “secondary” sources of data to validate that the software had truly configured the spacecraft to the expected safe state.

Morantz, Chaz↗