Evolution of the Preliminary Fault Management Architecture and Design for the Psyche Mission

The Psyche Mission presents the first opportunity to explore the largest metal asteroid in the solar system, (16) Psyche, which is believed to be the exposed core of a larger planetesimal that was stripped of its rocky mantle through multiple collisions during early solar system formation. The mission was selected in January 2017 for a 2022 launch as part of NASA's Discovery Program and is uniquely enabled by the integration of a Solar Electric Propulsion (SEP) Chassis delivered by Maxar Space Solutions with JPL's core deep space avionics, flight software, and fault management architectures. One of the key design tasks is the development of a fault management system capable of being responsive to the unique elements of the combined JPL and Maxar spacecraft architecture. This new design leverages the strengths of each organization, with Maxar delivering its well-proven highvoltage power bus and low-thrust electric propulsion subsystem from its GEO communications satellite product line, and JPL delivering its deep space mission expertise and the hardware and software most critical to deep space mission design. The development of a robust low-thrust mission and the integration of design philosophies and hardware from two organizations is not without its challenges though. A key challenge in the development of the Psyche fault management architecture and design is in the integration of design philosophies and hardware from JPL and Maxar. At the architecture level, Maxar GEO communications satellites are developed under the premise of highly responsive ground in the loop for the resolution of anomalies, and the implementation takes a fail-operational approach to minimize down time for its customers. In contrast, a deep space mission must be able to maintain safety with long periods of ground communication outage. Additionally, with no time-critical events after launch, the Psyche spacecraft will generally failsafe in the presence of anomalous conditions; special consideration is being given to this approach, however, to minimize the loss of electric propulsion thrust time, which is critical to low-thrust missions. At the hardware level, the detailed definition of interfaces between JPL and Maxar hardware presents a unique challenge in the development and flowdown of fault management requirements, the development and implementation of fault monitors and responses, and the development and verification of fault containment boundaries. This paper describes the evolution of the Psyche fault management architecture and design from the concept study into the preliminary design phase, with a focus on the unique challenges associated with flying GEO communications satellite hardware in deep space, implementing a robust low-thrust mission, and the integration of design philosophies and hardware from JPL and Maxar. Details regarding how these challenges are addressed in the fault management design in order to maximize heritage, leverage the strengths of each organization, and minimize risk across the design are also discussed.