

To ensure a recovery path, the system required to be designed against the normal rules, for example allowing a mechanism to reboot the spacecraft receivers. There are many ways into and out of the satellite, some quite unconventional such as a laser uplink path. After survivability, the next priority is ensuring the ability of the ground to recover the mission when a fault is detected. The solution is to design the FDIR system to concentrate on ensuring survivability of the spacecraft rather than the availability of the spacecraft. The mission will deal with the very acute problem of allowing experimenters to load on a daily basis their own on-board software and ground software with minimal testing.

This also extends to the ground system which must be designed to be replaceable on the same time scales. The FDIR system is unique in several ways not least because the mission concept involves replacing the entire on-board software suite, right down to operating system, on a daily basis. OPS-SAT is ESA's first nanosatellite mission and is the first mission worldwide to be designed exclusively to demonstrate groundbreaking satellite and ground control software under real flight conditions. This paper describes the unique Fault Detection, Isolation and Recovery (FDIR) concept of the ESA OPS-SAT project.
