Goal-based fault tolerance for space systems using the mission data system

In anticipating in situ exploration and other circumstances With environmental uncertainty, the present model for space system fault tolerance breaks down. The perplexities of fault-tolerant behavior, once confined to infrequent episodes, must now extend to the entire operational model. To address this dilemma we need a unified approach to robust behavior that includes fault tolerance as an intrinsic feature. This requires an approach capable of measuring operators' intent in the light of present circumstances, so that actions are derived by reasoning, not by edict. The Mission Data System (MDS), presently under development by NASA is one realization of this paradigm - part of a larger effort to provide multi-mission flight and ground software for the next generation of deep space systems. This paper describes the MDS approach to fault tolerance, contrasting it with past efforts, and offering motivation for the approach as a general recipe for similar efforts.