NASA Logo, National Aeronautics and Space Administration



Various simulation scenarios were developed to show the effectiveness of the ACM System. The scenarios discussed here incorporated any available prognostic information. In these scenarios a sensor degradation fault has been simulated. Based on how severe the sensor degradation is and the amount of estimated remaining useful life (RUL), decisions can change. The situation is further worsened by introducing a leakage fault in the system. We also show that in case of potentially severe failures, reconfigurations can be done at the mission level.

All examples under this scenario emulate a mission that aims to take a picture of a determined facility from two different altitudes (Figure a). The spacecraft switches between Thrust (T) and idle (I) modes to change orbits. The mission success is defined by its ability to take pictures and safely return back to its original orbit. If an irreparable and potentially fatal failure is encountered, the mission should be reconfigured for safe return even if all desired pictures can not be obtained. In the simulations results it can be seen how ACM performance changes with and without the prognostic information available to the system:

Original mission scenario and 2 others

(a) Original mission scenario with three thrust cycles (b) Reconfigured mission scenario with second thrust cycle shortened (c) Reconfigured mission with second thrust cycle omitted

The first scenario involves a complex situation with two simultaneous failures: sensor degradation and a leakage in the valve IV1 that affects the amount of gas remaining in the tank, and therefore reduces the amount of time thrust can be kept on.

Sensor degradation (starts at Point 1) is a relatively slow process. ACM initially adjusts the regulator set point (at cycle 25) to counter its effect, as depicted by red line. However, once the fault is detected a prognostic routine starts predicting the RUL of the regulator as shown. Since prediction indicates that the current regulator will fail before the next thrust cycle starts at cycle 100, it automatically switches to the redundant regulator and the system sees a normal operation from then on.

Graph of RG Out Pressure

a. ACM uses prognostic information to carry out system reconfiguration well in advance.


Point (2) in the following figures indicates the time instant when the leakage starts, affecting the propulsion system. The second scenario (see Figure b) shows a situation when the severity of the leakage condition is not critical. In this case, the mission reconfiguration block determines that the remaining amount of gas is not enough to carry out necessary operations for changing the orbit to reach the desired altitude. As a result, the picture will be taken from a modified altitude and the spacecraft will be able to safely return to the original orbit. Eventually, due to the leakage condition, the ACM system will turn on the heater but now only for a brief amount of time. Recall that heating is needed in order to increase the pressure at the input of the regulator (a necessary condition to keep the desired thrust). This action clearly reveals the inner optimization associated with the existence of an ACM system since there is a trade-off between the cost of using the heater and the cost of taking pictures from a different altitude than desired.

Graph of RG Out Pressure

b. ACM reconfigures the mission profile by reducing the thrust cycle in the event of minor valve leakage.


The final scenario is similar to the previous, except that this time there is a severe leakage condition. In this case, just reducing the thrust cycle for the second thrust period is not enough. Note that the problem of sensor degradation in the regulator is accommodated in a manner similar to the previous examples. Therefore, the mission reconfiguration in the ACM system decides to abort the imaging operation from the second altitude and safely return from the first orbit itself using the heater in order to maintain the desired thrust.

Graph of RG Out Pressure

c. ACM reconfigures the mission profile by eliminating a complete thrust cycle to accomodate severe valve leakage.

In all these examples, it is clear how different modules of the ACM (prognosis, system reconfiguration, mission reconfiguration, decisions about set point values, and heater usage) can interact in order to overcome situations, given a cost that is associated with the fulfillment of the mission and the rest of the actions involved.

First Gov logo
NASA Logo -