An update on Ulysses: Recovery from sun sensor anomaly

I posted on Monday about an anomaly on Ulysses possibly endangering the mission. In fact, by then Ulysses had already recovered, although that information wasn't yet available on the status reports page from which I got Nigel Angold's message to the Ulysses community. I won't repost Angold's full messages -- you can read them at that link -- I'll just summarize the story, with a bunch of help from an anonymous Ulysses team member, just to give you a window into the kinds of details that are involved in operating a deep-space mission.

Sun sensors are devices carried by pretty much every single deep-space spacecraft. Spacecraft use them to determine their orientation in space. For spacecraft like Ulysses that spin in order to stabilize their orientation, sun sensors also enable the spacecraft to measure its spin rate. Ulysses has two sun sensors, one a "cross-beam sun sensor" (abbreviated XBS) and the other a "meridian slit sun sensor" (abbreviated MS). Actually there are two meridian slit sensors, MS1 and MS2, each pointed 180 degrees to each other. For redundancy, there are two identical cross-beam sun sensors, named XBS1 and XBS2. The meridian slit sun sensors are internally redundant -- MS1 and MS2 each has a main and a standby unit. (For many more gory details, visit this website.)

Ordinarily, both XBS sun sensors are on, and the main MS sensors are on. But as I reported earlier, on September 19, when Ulysses made contact with Earth, it reported problems: one of the two XBS sensors was off, and the main MS1 sun sensor was also off. The spacecraft had erroneously determined its own spin rate to be twice its actual speed, triggering a cascade of events that included shutting off the latching valve that controls the flow of hydrazine to its thrusters. This was the acute problem -- with hydrazine not flowing, there was danger that the fuel could freeze at any time, which would prevent the spacecraft from pointing to Earth to communicate, ending its mission. So the first priority was to get that latch open and fuel bleeding started again, and then they could deal with the problems with the sun sensors that had triggered the problem in the first place.

So -- this is still on the 19th -- they quickly sent up commands to open that valve and to restart the fuel bleeding procedure, in which 1.2 grams of fuel is advanced through the fuel lines every two hours to prevent the fuel from freezing. They also commanded the main MS-1 sun sensor to turn off and commanded the standby MS-1 sensor to turn on.

The next time they talked to the spacecraft, they found that the standby branch of the MS-1 sun sensor still was not on, and that the latching valve was still closed. Either the commands to fix those problems had not executed properly, or whatever had caused the fault in the first place had happened again just after the commands had been received. So they had to try a new plan.

This time they told the spacecraft to calculate its spin rate without relying on one of those balky MS-1 sun sensors; they also disabled the program that monitors Ulysses' spin rate and shuts the latching valve if the spin rate is off-nominal. They commanded the valve open and the standby MS-1 on again, and this time everything worked. It must have been a hairy day in Ulysses operations. Angold summarized the results of these efforts with "it is not known why the MS-1 standby sensor was off and LV1 [the latching valve] closed at the beginning of the [communications] pass. Nor are we certain how many (if any) fuel bleeding manoeuvres took place out of pass. But the good news is that it looks like the fuel is not frozen."

Ulysses is now doing what it was doing before the anomaly happened in the first place -- eking out the last precious bits of science data from its long mission.