Introduction to complex fault protection software testing

This paper describes how fault protection (FP) software verification testing has been addressed for the attitude and articulation control subsystem on the Saturn-bound Cassini spacecraft. The verification included definition of failure injection capabilities to the test beds. The Cassini fault protection test program evolved using several test phases to complete separate goals which taken together encompassed all of the flight software complexities. This phased testing approach developed high confidence in the robustness and correctness of the FP flight software. Over 500 prelaunch tests of the flight software in a realistically modeled environment were used to ensure the design is robust to single faults. In the process we found that many double fault scenarios are handled by the Cassini attitude and articulation control subsystem FP software design