Dawn Journal: Software Updates

Dear Dawnocrats, Republidawns, and Indawnpendents,

Dawn continues its powered flight, having accumulated more than 100 days of ion thrusting since its launch nearly seven months ago. All systems are healthy as the probe patiently and persistently propels itself through the solar system.

In addition to its weekly hiatus in thrusting to point its main antenna to Earth for about six hours, Dawn's flight plan includes occasional longer non-thrusting intervals to conduct special activities. On March 31, the spacecraft stopped its ion beam, turned to Earth, reported on its activities from the previous week, and indicated its readiness (even eagerness!) for whatever plans mission control had devised. This period, scheduled well before launch, was planned to last 10 days.

To begin, the team loaded into the spacecraft's main computer updated software that simplifies operation of the science instruments. Such "science blocks" had already been used on the mission, but with the experience gained from the tests of the instruments in the initial checkout phase, the team made some improvements. After thorough testing with instrument simulators, the modified science blocks had been deemed ready for installation on the spacecraft. They were used during the rest of the week, as each of Dawn's science instruments received special attention.

With some of the updated blocks, operators powered on the Gamma Ray and Neutron Detector (GRaND) (whose name belies its unassuming demeanor) and let it collect data for about a week. GRaND is designed to measure radiation from Vesta and Ceres to reveal the chemical elements that compose the outermost material of these protoplanets. As described during the first test of GRaND after launch, gamma rays and neutrons will reach the instrument not only from the targets it wants to investigate but from elsewhere as well. Initially these signals were used to verify GRaND's health. Now scientists want to collect more such data to begin developing an accurate record of the effects of this omnipresent radiation. One part of analyzing the signals from the asteroids will be removing the "noise" that GRaND detects from cosmic rays, so it is essential to know its characteristics.

While the science blocks streamline the process of sending instructions through the main spacecraft computer to the instruments, the instruments themselves have internal computers and software as well. Updated versions of the software for the science cameras were passed through the spacecraft computer and installed in the cameras' computers. The new software includes capabilities that had been planned before launch but were not needed for earlier tests, and it corrects minor bugs (yes, some bugs are hardy enough even to survive extended periods in deep space) discovered during those tests.

After the software was loaded into the primary camera, operators commanded the instrument through a "minicalibration" to verify that the installation was successful. Upon completion of the work with the primary camera, they conducted all the same steps with the backup camera. The two cameras are essentially identical, so they received the same software. They are recognized by the spacecraft computer as distinct devices though, and they are not operated simultaneously, so to route software to both of them required executing the loading procedure twice.

The team also conducted new calibration tests of the visible and infrared mapping spectrometer (VIR). The unit displayed excellent performance in the initial checkout phase, but as with most complex instruments, many tests are required in order to characterize its performance fully. For this calibration, the spacecraft pointed VIR to the star Canopus. From Earth, the only stars that appear brighter are the Sun and Sirius, but Canopus is a familiar sight to many observers besides those who are far enough south to see it from Earth. Canopus is one of the intrinsically brightest stars for hundreds of light years, shining brilliantly in the skies of many planets in this neighborhood of the Milky Way galaxy. When the measurements of Canopus were complete, Dawn rotated to aim VIR at Mars. At a distance of more than 55 million kilometers (34 million miles), that was the closest planet to the spacecraft. Too distant to be observed with any detail, the red planet provided a good infrared signal for testing the instrument.

Turning their attention away from the instruments, operators loaded the latest version of software to the backup main computer. Software version 7.0.3 was installed in the main computer on February 15, and the same update now resides in the primary and backup locations of the backup computer, ready to be used if the spacecraft detects a serious problem with the primary computer.

The last planned activity of this period was a test of how accurately ion thruster #2 can be pointed. (The naming convention for the thrusters is explained in text in a previous log. For an enjoyable explanation in another medium, see a performance of the new and popular Dawn pas de trois.) Such tests were conducted for the other two thrusters when they were checked out during the month after launch. This test was not run with #2 because the spacecraft was still too close to the hot Sun even in November when thruster #2 was put through all of its other tests. (The different positions of the thrusters on the spacecraft means they experience different temperatures when they are operated.) There was no urgency in making this measurement, so it was postponed to this convenient opportunity.

On April 8, the spacecraft oriented itself as required for the test. Executing the same steps it always does to start a thruster, this time the ion propulsion system's computer controller detected a potential problem and halted thruster operation. Because of the orientation of the spacecraft, the radio signal received on Earth was so weak that data could be returned only very, very slowly. Mission control saw an indication that the onboard controller had stopped the thruster, so they radioed new instructions to end the test and turn to point the main antenna to Earth. Meanwhile, when an onboard system found that there was no thrust, it issued different instructions to accomplish the same ends: stop the rest of the test and aim the antenna at Earth. Either set of instructions would have worked, but the computer trying to process both sets led to a conflict, so it responded by entering "safe mode."

Safe mode is a standard response designed into the software to deal with uncertain, unexpected, or difficult conditions. Nonessential systems are powered off, and essential systems are reconfigured according to a plan stored in software. The details of that plan were modified in October and again in January to account for the spacecraft's growing distance from Earth and the Sun.

In safe mode, just as in the orientation for the test, the use of an auxiliary antenna greatly limits the amount of data that can be returned. Although controllers soon recognized the conflict that triggered safe mode, many steps in a carefully planned and methodical process were required to reconfigure the spacecraft to point the main antenna to Earth. To expedite this work, colleagues working on the Mars Odyssey and Mars Reconnaissance Orbiter projects agreed to exchange their scheduled use of one of the Deep Space Network's largest antennas, a 70-meter (230-foot) dish at Tidbinbilla, Australia, with Dawn's use of a 34-meter (112-foot) antenna at the same communications complex. The larger antenna allowed the Dawn team to send and receive data at greater speed; this significantly reduced the time it would have taken to return to normal operations. Such cooperative use of the shared resources of the Deep Space Network is one of the many ways missions work together to the benefit of all space exploration.

By April 11 the main antenna was pointing to Earth and all the data stored during the aborted thruster test had been returned and analyzed. Engineers recognized that there had not been a problem after all, and the thruster could have operated perfectly well. The ion propulsion control software sets and verifies many electrical parameters and checks many others to ensure the thruster is performing correctly. In this case, the software was conducting a check that was unnecessary, so there was no need for it to interrupt the thruster operation. The test was built into the software before the ion propulsion system received its exhaustive test flight on Deep Space 1. With the knowledge gained on that mission, this software check was determined to be unimportant, but given the overall complexity of the software, it had not been removed from the ion controller. The controller dutifully carried out its programming, not knowing that it was performing an unwanted function.

In all the thrusting conducted so far in the mission (and the far greater duration of thrusting on Deep Space 1), this unnecessary test had never tripped. Now engineers were able to calculate that the conditions required to indicate a (false) problem would arise later in the Dawn mission with the use of any of the thrusters, but the conditions would not occur for some time with thruster #3, which has been the one in use since December. Therefore, the "go" was given to resume thrusting, and on April 14 the spacecraft began its powered flight once again. (The entry into safe mode did not interfere with any special activities other than the pointing test of thruster #2, as that was the last planned event of this period.)

Now that the necessity of making a change in the ion controller software was identified, the fix itself was determined to be quite simple. In just a few days it was thoroughly tested in a simulator at JPL and was transmitted to the spacecraft during the next weekly communications session on April 21.

Dawn is 185 million kilometers (115 million miles) from Earth, or 480 times as far as the moon and 1.24 times as far as the Sun. Radio signals, traveling at the universal limit of the speed of light, take almost 21 minutes to make the round trip.

Dr. Marc D. Rayman
6:00 am PDT April 22, 2008