Safing and fault protection for the MESSENGER mission to Mercury

The MErcury Surface, Space ENvironment, GEochemistry, and Ranging (MESSENGER) mission is a NASA Discovery-class, deep-space mission to orbit the planet Mercury. Its purpose is to map the planet surface using various scientific instruments and explore the interior of the planet using measurements from instruments such as a magnetometer and observation of planetary libration. This paper discusses the architecture and implementation of the methods by which faults in the MESSENGER spacecraft are detected and the effects of those faults mitigated. The responsibility of the redundant Fault Protection Processors (FPPs) is to detect faults and take autonomous corrective actions that will keep the spacecraft healthy and safe.