Beyond the Hardware: The Documentation Package & Harness Coming with a Flight-Ready On-Board Computer

Declare Process List & Manufacturing and Product Configuration Documentation

Documents such as the MPMPL provide important information about the manufacturing and configuration of the product. For a flight unit, knowing what was actually manufactured is just as important as knowing what was originally designed. Space projects therefore place strong emphasis on configuration management. ECSS configuration-management guidance addresses the identification of configuration items, documentation, baselines, changes and the as-built configuration. This allows the customer to maintain traceability between the design, manufacturing process, delivered hardware and supporting documentation.

FMEA — Understanding How the OBC Can Fail

The Failure Modes and Effects Analysis examines potential failure modes and their consequences. For an OBC, this can extend from individual components and circuits through functional blocks and ultimately to the equipment-level consequences. The purpose is not simply to create a list of possible failures. Usually along with FMEA, we provide both functionals & physical block diagram of products which is helping in both FMEA, FDIR & Reliability assessment. FMEA helps engineers understand:

What can fail → how can it fail → what is the consequence → can the failure be detected → can it be controlled or mitigated?

ECSS specifically identifies FMEA/FMECA as a dependability activity intended to support mission performance, dependability and safety objectives. It also identifies its relationship with redundancy, critical items and FDIR. For redundant OBC architectures, this analysis becomes particularly valuable because it can demonstrate how the system responds when one computing element becomes unavailable.

A typical FMEA sheet for an OBC can be a sheet with more than 100 failure modes & more than 20 columns to cover ECSS requirements.

CIL — Critical Item List

The Critical Item List (CIL) identifies items that require particular attention because of their potential impact on mission performance, safety or reliability. The CIL provides the customer with visibility of critical aspects of the OBC design and supports the wider spacecraft dependability and product-assurance process. This is especially important for equipment containing high-value or mission-critical functions.

FDIR — Fault Detection, Isolation and Recovery

A spacecraft cannot rely only on preventing failures. It must also be capable of responding to failures when they occur. The FDIR documentation describes how faults can be detected, isolated and recovered. For example, a fault may be detected through monitoring of Processor health, Power rails, Communication interfaces, Memory status, Watchdogs, Temperature, Internal telemetry & Software or hardware health indicators. FDIR is probably most important documents manufacturer is providing to system integrator to show how system can then take an appropriate recovery action for an end user.

For a redundant OBC architecture, this could include switching operation from the active OBC to the redundant unit. This is where reliability analysis and system architecture come together. ECSS guidance explicitly identifies FMEA/FMECA as an input to FDIR design and requires analysis of how anticipated failure modes can be detected and controlled.

Reliability Assessment

The Reliability Assessment provides an engineering assessment of the expected reliability of the OBC. It can consider component reliability, operating conditions, environmental stresses, derating, architecture and other relevant factors. For the spacecraft customer, this provides quantitative engineering evidence supporting the use of the OBC in the mission. For architectures such as a dual-redundant CDH system, reliability analysis can go one step further by considering the contribution of redundancy to overall system availability and reliability.