Author: Judy Long
Company: CLRC

SPIRE-RAL-COM-000572

From:	King, KJ (Ken)  
Sent:	15 January 2001 12:38
To:	'Otto H Bauer (E-mail)'; 'Helmut Feuchtgruber (E-mail)'; 'Anna di Giorgio (E-mail)'; 'Renato Orfei (E-mail)'; 'Peter Roelfsema (E-mail)'; Sidher, SD (Sunil) ; 'Paolo Saraceno (E-mail)'; 'Wim van Leeuwen (E-mail)'; 'Herman Jacobs (E-mail)'; 'Stephano Pezzuto (E-mail)'; 'Douwe Beintema (E-mail)'
Subject:	Action OBS2-01 

To confirm whether SPIRE should be switched off when the hardware watchdog in the DPU is activated.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The hardware watchdog is intended to identify the condition that the OBS is not operating correctly. In this case it is important that action is taken to protect the instrument (as the software has probably crashed it is possible that it will send unintended commands to the instrument subsystems). As the OBS is already not operating correctly, we cannot rely on it to take action itself. 

Assuming the hardware watchdog is implemented using a non-maskable interrupt (i.e. this is a hardware reset of the microprocessor, which is different from a cold start), our recommendation is that the DPU should jump to a condition that does not send any command to the instrument (e.g. reset to an infinite loop) or respond to the spacecraft. The consequence of this is that the 'Are you alive' command from the spacecraft will fail and appropriate action will be taken by the CDMS (i.e. switching off the instrument).

Ken