In-Flight Anomalies and Lessons Learned from the Mars Reconnaissance Orbiter Mission

The Mars reconnaissance orbiter mission has as its primary objectives: advance our understanding of the current Mars climate, the processes that have formed and modified the surface of the planet, and the extent to which water has played a role in surface processes; identify sites of possible aqueous activity indicating environments that may have been or are conducive to biological activity; and thus, identify and characterize sites for future landed missions; and provide forward and return relay services for current and future Mars landed assets. MRO´s crucial role in the long term strategy for Mars exploration requires a high level of reliability during its 5.4 year mission. This requires an architecture which incorporates extensive redundancy and cross-strapping. The overall MRO architecture is discussed in this context. Because of the distances and hence light- times involved, the spacecraft itself must be able to utilize this redundancy in responding to time-critical failures. The architecture of MRO´s semi-autonomous fault protection (FP) software, known as SPIDER (spacecraft imbedded distributed error response), is described. For cases where FP is unable to recognize a potentially threatening condition, either due to known limitations or software flaws, intervention by ground operations is required. Each of MRO´s significant in-flight anomalies is examined, with lessons learned for redundancy and FP architectures and for ground operations.