Intrinsic Hurdles in Applying Automated Diagnosis and Recovery to Spacecraft

Experience developing and deploying model-based diagnosis (MBD) and recovery and other model-based technologies on a variety of testbeds and flight experiments led us to explore why our expectations about the impact of MBD on spacecraft operations have not been matched by effective benefits in the field. By MBD, we mean the problem of observing a mechanical, software, or other system and determining what failures its internal components have suffered using a generic inference algorithm and a model of the system´s components and interconnections. These techniques are very attractive, suggesting a vision of machines that repair themselves, reduced costs for all kinds of endeavors, spacecraft that continue their missions even when failing, and so on. This promise inspired a broad range of activities, including our involvement over several years in flying the Livingstone and L2 onboard MBD and recovery systems as experiments on Deep Space 1 and Earth Observer 1 spacecraft. Yet, in the end, no spacecraft project adopted the technology in operations nor flew additional flight experiments. To our knowledge, no spacecraft project has adopted any other MBD technology in operations. In this paper, we present a cost/benefit analysis for MBD using expectations and experiences with Livingstone as an example. We provide an overview of common techniques for making spacecraft robust, citing fault protection schemes from recent missions. We lay out the cost, benefit, and risk advantages associated with onboard MBD and use the examples to probe each expected advantage in turn. We suggest a method for evaluating a mission that has already been flown and providing a rough estimate of the maximum value that a perfect onboard diagnosis and recovery system would have provided. By unpacking the events that must occur in order to provide value, we also identify the factors needed to compute the expected value that would be provided by a real diagnosis and recovery system. We then di- - scuss the expected value we would estimate that such a system would have had for the Mars Exploration Rover mission. This has allowed us to identify the specific assumptions that made our expectations for MBD in this domain incorrect.