Prototyping of Processor Warm Redundancy in Critical Phases

Reliability of most data handling systems used for space mission is based on redundancy concept. In particular, in order to be robust to one failure, one classical solution is to use two redundant processor modules: One nominal used by default, and one backup used in case of failure of first one. This redundancy may be in cold, warm or hot configuration, each of these configurations presenting specific advantages and drawbacks. For ExoMars Carrier Module critical mission phases (before Descent Module separation), the warm redundancy has been chosen as a compromise between compliance with tight mission time constraints and system simplicity. This concept of warm redundancy had been previously tested and validated by Thales Alenia Space France through the realisation of a prototype in Cannes premises. The purpose of this paper is to present the principles of this warm redundancy prototyping and its main results.