ExoMars 2016, Orbiter module bus a GNC development update

Abstract

ExoMars programme is part of a cooperation between ESA and Roscosmos. It foresees two missions to Mars that aim to searching for signs of past and present life on Mars, investigating the Martian atmosphere and surface and demonstrating the technologies needed to land on Mars and perform robotic exploration. The first spacecraft launched in early 2016 is composed of an Orbiter module (the Trace Gas Orbiter, TGO) carrying an entry descent and landing demonstration module (EDM) The Orbiter GNC design shall allow the spacecraft composite to cruise towards Mars, to accurately release the EDM, to make orbit insertion in Mars orbit with chemical propulsion system, to circularise the orbit by aerobraking and perform atmosphere observation with the four payloads instruments while relaying communication from assets on Mars surface. After a brief presentation of the ExoMars mission and constraints, the paper first provides an overview of the TGO GNC design (in term of mode and sensor/actuator), then an updated status of development is given. A special emphasis is given to the GNC level implementation of the aerobraking strategies and on specific FDIR features.

1 ExoMars mission overview

ESA will design, build and integrate a large spacecraft composite with a launch mass of about 4.3 tonnes consisting of an ESA Orbiter which will carry two European and two Russian orbital science instruments, the NASA provided Electra UHF transceiver and the 600 kg ESA EDL demonstrator module (EDM).

The spacecraft composite will be launched in January 2016 from Baikonur by a Roscosmos provided Proton-M/Breeze-M launcher into a direct injection T2 type interplanetary transfer trajectory to Mars, and will arrive at Mars approximately, 9 months later in mid-October of 2016. Prior to arrival at Mars, the EDM will be released from the Orbiter and will enter the Martian atmosphere from the hyperbolic arrival trajectory.

Following separation from the EDM, the Orbiter will go into orbit around Mars to perform a primary science phase of one Martian year followed by a Mars proximity communications phase. The Mars proximity communications portion of the mission will support the 2018 Rover mission as well as any other international assets on the surface of Mars throughout 2022.

The release of the EDM will take place 3 days prior to the critical Mars orbit insertion (MOI) manoeuvre by the Orbiter.

Upon completion of the MOI manoeuvre, the Orbiter will be in a four sols elliptical orbit around Mars and after 2.5 orbits will begin a series of manoeuvres to change the orbit inclination to 74° and reduce the apoapsis to that of a one sol orbit using on-board fuel reserves. Further reductions of the apoapsis will be performed using aerobraking techniques followed by a final circularisation manoeuvre to arrive at the final science and Mars proximity communications orbit with an altitude of about 400 km.

The science operations phase is expected to begin in the autumn of 2017 (depending on the actual duration of the aerobraking phase) and last for one Martian year. The science instruments on-board will remotely sense the presence, quantity and potential sources of trace gases in the Martian atmosphere. Near the end of the science operations phase the 2018 mission Rover should arrive at Mars in early 2019 so that the emphasis on the Orbiter operations will shift to support the Rover should other communications assets not be available in orbit around Mars. The Orbiter will be designed for consumables that will allow further communications support and science operations until the end of 2022 with extended operations possible to 2025 depending on the nominal consumption of fuel in-orbit.

The EDL demonstrator will provide Europe with the technology of landing on the surface of Mars with a controlled landing orientation and touchdown velocity. The design maximises the use of technologies already in development within the ExoMars programme. These technologies include:

• Thermal protection system material

• Parachute system

• Radar Doppler altimeter

• Liquid propulsion-controlled final braking

The configuration of the ESA EDL demonstrator will be developed keeping in mind the scalability to future larger landers. Engineering sensors will be incorporated into the design to assess the performance of the system throughout its EDL phase. The EDL demonstrator will have a heat-shield diameter of about 2.4 m and will support entry from the incoming hyperbolic trajectory. The system will be designed to survive the possibility of a severe dust storm since it will arrive at a period of high probability of encountering a Mars global dust storm. After entry, the system will deploy a single stage disc gap band parachute and will complete its landing using a closed-loop guidance, navigation and control (GNC) system based on a Radar Doppler altimeter sensor and on-board inertial measurement units that will guide a liquid propulsion system by the actuation of thrusters to be operated in pulsed on–off mode.

The EDL demonstrator is expected to survive on the surface of Mars for a short time (a few sols) using the excess energy capacity of its primary batteries. A set of scientific sensors will be embarked as a demonstration of surface science, within the mass and electrical (including radio-frequency) resources available in the EDL demonstrator (see Fig. 1).

Fig. 1

ExoMars mission profile

2 TGO overview

The main characteristics of the ExoMars Orbiter (called Trace Gas Orbiter, TGO––in reference to its main scientific goals) are:

• Launch mass (including EDM): 4,332 kg

• Dry mass (w/o EDM) 1,400 kg

• Typical inertia:

  Deployed after launcher separation 5,200/11,000/7,400 kg m²

  Dry without EDM 4,500/5,700/2,200 kg m²

• Bipropellant MON–MMH propulsion system with two 1,107 litres propellant tank housed in central tube feeding a 420 N main engine and a set 10 nominal (+10 Redundant) reaction control thrusters

• Two deployable solar arrays wing of a total surface of 21.7 m² covered by triple junction AsGa cells delivering 2,200 Watts @1.65 AU, this wings are mounted on a 1 axis. SADM (solar array drive mechanism)

• 2.2 m X-band high gain antenna (HGA) mounted on a 2-axis antenna pointing mechanism (APM) allowing simultaneous nadir pointing and Earth communication while in Mars orbit (see Fig. 2).

  Fig. 2

  

  ExoMars composite

The P/L suite is constituted of four instruments mounted on a stable payload deck:

• Two Russian instruments

• FREND (fine resolution epithermal neutrons detector) aims to perform cartography of water present under the Martian surface.

• ACS (atmospheric chemistry suite) investigates the structure of the Martian atmosphere (to get a better understanding of Martian climate).

• Two European instruments

• NOMAD (Nadir and Occultation for Mars Discovery) have the objective to measure Mars atmosphere chemical composition with high precision. It addresses scientific issues such as present volcanism and sources of trace gases.

• CASSIS: colour and stereo surface imaging system. It will provide 3D colours images of Mars surface (aiming to certify potential future landing sites).

3 GNC design

3.1 Design drivers

Although the TGO design inherits from previous Thales Alenia Space AOCS design (mainly Spacebus 4000 GEO platform) the highly specific ExoMars mission profile have imposed significant design effort.

The main mission specific drivers for ExoMars are:

3.1.1 Delta V manoeuvre

To achieve the ExoMars mission profile the TGO shall have the capability to perform accurate DV manœuvre ranging from few cm/s (trajectory control manoeuvres, TCMs) to 1,400 m/s (MOI) using either only the reaction control thruster (RCT) or using also the 420 N main engine.

The Delta-V accuracy objective (1 % for boost above 1 m/s) makes the use of an accelerometer mandatory.

All the boosts have to be performed with fully deployed solar arrays.

3.1.2 Minimisation of parasitic DV

Landing accuracy requirements on the EDM induces tight requirement on pre-separation navigation and thus minimization of the parasitic DV induced by GNC (wheel unloading, safe mode, etc.). Parasitic DV is also critical in case of safe mode while in aerobraking. This requirement imposes a control thruster configuration capable of generating torque without residual force.

3.1.3 EDM separation

Although the separation Delta-V and angular rate are imparted by a spring-based separation mechanism, the TGO GNC shall be able to support the release operations and especially to recover Earth pointing shortly after separation.

Furthermore, the release of the 600 kg EDM results in a significant variation of the inertia. Practically, each GNC mode requires two different tunings (with or without EDM).

3.1.4 Aerobraking

Aerobraking consists of lowering the periapsis to benefit from aerodynamic drag to reduce the apoapsis down to 400 km. For ExoMars TGO, the target dynamic flux is 1,400 W/m² (or 250 kJm² energy limit whatever limit is reached first).

Control during aerobraking primarily relies on aerodynamic stability; however, GNC level implementation of aerobraking requires a dedicated mode, but also an adaptation of the safe mode and the implementation of specific functions to increase the autonomy from ground.

3.1.5 Science orbit operation

The selected science orbit is a 400 km nearly circular orbit with an inclination of 74° and thus can experience any elevation of the Sun wrt orbital plane. To avoid a complex 2-axis solar array mechanism a yaw steering pointing strategy has been selected.

Yaw steering also ensures that the +X panel remain in shadow allowing implementation of efficient P/L radiator (note that to fulfil this need, the yaw steering strategy is applied whatever the Sun elevation and not limited to high elevation).

However, not all the P/L instrument is compatible with nadir pointing with yaw steering:

• High-resolution stereo imager requires fixed yaw during imaging. The telescope is mounted on a yaw mechanism to position the detector in an adequate way during the imaging while at TGO level the yaw motion is stopped.

• Sun occultation P/L requires inertial pointing during ~300 s before and after eclipse entry. To limit the slew amplitude (and thus the duration) the telescopes of the Sun occultation P/L are shifted about 64° from nadir, however, the TGO shall “freeze” its attitude twice per orbit and recover nadir pointing after (see Fig. 3).

  Fig. 3

  

  Pointing in science orbit

3.2 Sensor actuator suite

The ExoMars TGO GNC relies on “off-the-shelf” sensors and actuators:

3.2.1 Star tracker (STR)

The selected STR is the AA-STR from Selex Galileo (Italy); it is a light weight (2.6 kg) fully autonomous 3-axis STR.

It was developed for the Bepi-Colombo programme and is currently flying on the AlphaSat S/C.

For TGO, the AA-STR is fitted with a 28 V power interface, a 1553 data interface and a 26° Sun exclusion angle baffle.

The star trackers are mounted on the P/L deck close from the P/L instrument. This layout maximises the angular distance from Sun and shields the optics from the aerobraking flux.

3.2.2 Inertial measurement unit (IMU)

Two Honeywell MIMU are mounted on the TGO.

MIMUs are 3-axis medium accuracy gyros (typical ARW 0.01 deg/sqrt(h)) using ring laser gyros (RLGs) technology. For ExoMars the RLGs are complemented by three QA3000 beam accelerometers.

MIMUs are used (in gyro only configuration) on most Spacebus-4000 and have also been widely used on many European and American interplanetary mission.

MIMUs are dissipative unit (~30 W) are thus mounted-Z radiator panels.

3.2.3 Coarse Sun sensor (CSS)

The CSS consists of a set a four nominal and four redundant solar cells mounted on a pyramidal bracket. A baffle is shaping the field of view as required to avoid interference with HGA and solar array.

It is fully recurrent from Spacebus-4000 units, however, for TGO two similar units are mounted on the S/C (with ±30° tilt) allowing to scan the full sky within a single rotation around TGO Z-axis.

3.2.4 Reaction wheels

Four RSI-20-215 Rockwell–Collins–Deutschland (RCD) reaction wheels are mounted on the TGO. These wheels have 20 Nms momentum capacity at full 0.2 Nm torque capacity.

They are recurrent from Herschel reaction wheels and are also used on Sentinel-3 (with similar interface on SMU (satellite management unit)).

The reaction wheels are classically arranged in a quasi-tetrahedral configuration. Indeed, the Y axis is favoured in terms of momentum capability to cope with yaw steering requirement (see Fig. 4).

Fig. 4

ExoMars TGO GNC sensor/actuators

3.2.4.1 Reaction control thruster (RCT)

A specific thruster configuration has been defined for ExoMars.

The design drivers for RCT accommodation are the following:

• High roll (Xsc) torque efficiency for efficient RW unloading in Science

• High pitch/yaw (Ysc, Zsc) torque efficiency to limit attitude control consumption during boost

• High efficiency DV capabilities

• Force-free torque capability to unload RW during DV critical phase (Mars approach, aerobraking)

• Limitation of the thermal flux on HGA/SA but also on the DM

The resulting configuration is a 10 nominal + 10 redundant thruster’s configuration organised in three sets.

• Set A thrusters (4 nominal + 4 redundant) are aligned with Xsc axis provide Xsc DV capabilities and pitch and yaw torque capabilities (>17 Nm per axis).

• Set B (4 nominal + 4 redundant) are significantly tilted to provide good roll capabilities (>20 Nm),

• Set C (2 nominal +2 redundant) is a force compensation set, when operated by pairs they provide a−X impulse to compensate the +X impulse from set A and set B (see Fig. 5).

Fig. 5

TGO reaction control thruster configuration

3.3 Modes

Five GNC modes have been developed to fulfil the ExoMars Orbiter GNC requirements:

3.3.1 Sun acquisition mode (SAM)

This mode is engaged after launcher separation or in case of FDIR alarm requiring return to satellite safe mode. CSS, Gyrometers (GYR) and RCT are used to acquire Sun direction and take the Sun pointing attitude (−Xsc towards the Sun).

3.3.2 Normal mode with propulsion (NOMP)

This mode is used in satellite safe mode to communicate with Earth at high data rate with an inertial S/C attitude and an Earth HGA pointing. It is also designed to provide high-rotation rate slew, to deal with the EDM release sequence and to prepare the transition into the high accuracy pointing mode with reaction wheels. STR and GYR are hybridised into a Kalman filter to provide continuously a S/C attitude and rate estimate. RCT provides enough torque to create or damp high S/C rate.

3.3.3 Normal mode with reaction wheels (NOMR)

It is used in cruise phase, in aerobraking phase on the exo-atmospheric arc and in science and data-relay phases. The gyro-stellar estimator offers precise pointing for science mission and the four reaction wheels (RW) in skewed configuration provide capability to follow accurately the attitude target profiles needed by payload instruments.

3.3.4 Orbit control mode (OCM)

All Delta-V manoeuvres can be performed in OCM using RCT and the main engine (ME) combined with the gyro-stellar estimator. Precise small Delta-V manoeuvres require a NOMR-OCM-NOMR sequence but the NOMP-OCM-NOMP sequence is also available. The Delta-V estimation is performed with accelerometers (ACC) or with a book-keeping on-board function based on a model of RCT and ME thrust.

3.3.5 Aerobraking mode (AEBM)

For aerobraking pass at orbit periapsis, this mode uses GYR and RCT to follow approximately, the attitude target. Delta-V produced by the pass is measured with the accelerometers.

The GNC mode transitions are described in the Fig. 6.

Fig. 6

TGO GNC mode transition diagram

3.3.5.1 Sun acquisition mode (SAM)

Sun acquisition mode is designed to recover Sun pointing along −X from any initial conditions and rates up to 18 deg/s, it uses CSS and IMU as sensor and thrusters as actuators.

The first step of SAM consist in a rate damping allowing to cope with large initial angular rate.

Then the Sun search is engaged, the pair of CSS allows a full scan of the sky with a single rotation around S/C Z axis. Should an eclipse occur, the Sun search rotation will be maintained at minimal propellant expense until eclipse exit.

Upon detection of the Sun by one of the CSS, Sun pointing submode is engaged aiming to point −X towards Sun.

Finally, after Sun pointing convergence, a slow spin around X-axis is commanded (0.1 deg/s). This spin aims to ease the acquisition of the STR (changing slowly the stars pattern within field of view and avoiding long-term blinding by planet).

In addition, SAM implements a dedicated submode to cope with aerobraking conditions:

• A disturbing torque estimator using gyro data allows detecting entry in aerobraking pass whatever the SAM submode (excepted rate damping).

• In case of detection the current submode is abandoned, and a loose rate damping is applied allowing passive reorientation towards aerodynamically stable attitude.

• After a time-out the nominal sequence of SAM is reengaged (rate damping or Sun pointing depending on whether Sun has already been detected).

Figure 7 shows a typical example of SAM sequence interfering with an aerobraking pass (between 1,000 and 2,000 s).

Fig. 7

Typical SAM behaviour during aerobraking

3.3.5.2 Nominal mode with propulsion (NOMP)

Nominal mode with propulsion is designed to acquire and follow 3-axis pointing using thrusters as actuators. It uses STR and IMU.

It features four sub modes: slew, attitude keeping, atmospheric rate damping (ARD) and separation.

Slew sub-mode is based on a large angle controller that can deal with any initial attitude error and large angular rate error.

When final target is reached, the attitude keeping sub-mode is autonomously engaged. The attitude keeping controller is tuned to minimise propellant consumption while the slew controller is tuned to optimise slew duration.

As SAM, NOMP is used in the safe mode sequence; therefore, aerobraking rate damping (ARD) is also implemented allowing coping with an aerobraking pass while in NOMP. The NOMP ARD design is similar with the SAM’s one with specific tuning.

Separation submode will be used to handle the actual EDM separation. While in EDM separation submode, the attitude estimation is still running using IMU integration only (to avoid any risk blinding or perturbing the STR by DM or small debris released by separation) but the thruster actuation is inhibited.

This submode is entered shortly before the actual separation and maintained during 1 min to allow sufficient clearance between TGO and EDM, NOMP is then reinitialised with a set of controller tuning adapted to the post-separation inertia.

Figure 8 shows typical attitude recovery sequence following EDM separation in NOMP. The excitation of the solar array flexible mode by the separation impulse is clearly visible on the angular rate plot.

Fig. 8

EDM separation recovery in NOMP

Sun pointing attitude is recovered within 10 min.

3.3.5.3 Orbit control mode (OCM)

Orbit control mode is dedicated to the realisation of the DeltaV manoeuvre all along the mission.

Three modes of operation are possible in OCM:

• Boost with main engine with RCT in “on-modulation” (to optimise of the overall specific impulse when gravity losses is not an issue)

• Boost with main engine with RCT in “off-modulation” (to optimize of the overall thrust, required to minimise gravity losses during MOI)

• Boost with RCT only in “off-modulation”

OCM also feature an attitude-keeping submode (similar in design NOMP attitude keeping).

The attitude estimation relies on gyrostellar hybridization, with a specific tuning to cope with the higher dynamic.

Orbit control mode commands the boost cut off using either integrated accelerometer data (nominal) or book-keeping (back-up) using an accurate on-board model of the RCT and ME impulse.

To support fail-op operation (MOI) OCM can be restarted from a context periodically safeguarded in SGM containing essential data as for instance the DV remaining to perform. Figure 9 shows typical pointing performances during MOI.

Fig. 9

Typical pointing performances during MOI

3.3.5.4 Nominal mode with reaction wheels (NOMR)

Nominal mode with reaction wheels is a reaction wheel control mode used most of the time during the mission

• In interplanetary cruise for routine inertial pointing and for large amplitude slews towards boost attitude,

• In aerobraking for inertial pointing during the exoatmospheric arc and for slews towards and from aerobraking pass attitude,

• In Science/data-relay orbit to follow the guidance profile required by Science/communication objectives,

• In safe mode as final inertial Sun–Earth pointing mode (if no previous failure on reaction wheels, otherwise the S/C remains in NOMP). In this case, the NOMR transition TC is triggered by the FDIR manager and specific guidance parameters are loaded from safeguarded memory

As for OCM and NOMP the attitude estimation is achieved by a gyrostellar estimator.

As NOMP, NOMR is based on a large angle controller behaving as a slew controller far away from target and a classical PID at small angle. While large slews are preferably done following a guidance profile, this capability is planned to be used to recover exo-atmospheric attitude following AEBM.

To improve the performances while following the complex science orbit attitude profile a torque feed forward is computed from the guidance profile and added to the control torque.

Nominally, the four RW are used and are commanded to avoid zero-crossing by managing the kernel of the commanding matrix. This function also allows to lower the RW speeds during high-resolution imaging and thus to reduce the micro-vibration.

In case of failure of one of the reaction wheel NOMR can achieve the control with the three remaining wheels without performance degradation excepted attitude transient around zero crossing.

NOMR features an unloading submode which can be triggered in two different ways.

• Automatically, if the speed of one of the reaction wheel exceed threshold. This feature is used especially when NOMR is used as final step of the safe mode without ground support.

• On ground command. In this case, the momentum target is defined in term of total SC momentum (body + Wheel) defined in inertial frame. This approach allows performing accurate unloading while attitude is changing to follow the guidance profile.

Proper phasing of RW command and unloading pulses allows minimising attitude transient during unloading.

In Mars orbit, the disturbance torque is dominated by the effect of the residual inertia cross product and unloading shall be performed twice a day.

The following figures show typical performances in NOMR over a whole science orbit. (curves are colour coded: blue = nadir pointing yaw steering, red = inertial pointing for Sun pointing, green = nadir pointing with fixed yaw for HR imaging, black transient phases).

• Outside of the transient phase between different type of pointing the control error remains lower than 100 microrads (about 200 microrad for worst cases).

• Attitude estimation error (upper/right curve) remains below 50 microrads on all axis (150 microrads in worst case mainly induced by STR to IMU thermoelastic distortion).

• Lower curve shows the actual angular rate and illustrates the considered guidance profile (see Fig. 10).

  Fig. 10

  

  NOMR typical performances

4 Aerobraking specific features

While the other modes largely inherit from geostationary (Spacebus-4000) or low-Earth orbit (Proteus) AOCS design, the implementation of the aerobraking have required specific design and analysis. This section summarises the main specific analysis and design to support aerobraking.

4.1 Aerodynamic analysis

The attitude control during aerobraking is primarily ensured by the passive aerodynamic stability yielded by the shift of the solar array attachment point with respect to the centre of gravity (as a wind vane).

To support the GNC and system analysis, the aerodynamic force and momentum coefficient have been analysed for a dense grid of attitude using a geometrical model of the TGO derived from CAD (Fig. 11).

Fig. 11

DSMC simulation computational grid

At high altitude the aerodynamic forces and moment can be approximated by free molecular hypothesis, however, at typical periapsis altitude (110 km) the mean free molecular path becomes lower than the TGO typical dimension and DSMC (direct simulation Monte Carlo) analysis shall be performed.

Figure 12 illustrates the output of theses analysis showing the momentum coefficient evolution as a function of the aerodynamic angle and Knudsen number (Knudsen number is the ratio of the mean molecular path to S/C typical dimension).

Fig. 12

TGO aerodynamic coefficients red Free-molecular/green Knudsen Number (Kn) = 6.9/yellow Kn = 0.9/black Kn = 0.09/blue Kn = 0.009

The rightmost curves show the integral of the momentum coefficient vs. angle showing clearly the existence of a unique stable equilibrium position whatever the Knudsen number.

The aerobraking database is interpolated in term of attitude and Knudsen number in all aerobraking-related GNC simulations.

An uncertainty of 10 % on force and momentum coefficient has been considered in the AEBM analysis. Specific database have been built to account for distorted SA geometry (bending and wind mill).

4.2 Aerobraking submode

While attitude control in aerobraking is mainly achieved through passive aerodynamic stability, a large attitude angular and rate deadband control is applied during the passes to limit the amplitude of the oscillation around equilibrium position and ensure controlled thermal conditions to the TGO.

A “diamond”-shaped deadband in the phase plane is well-adapted to control the aerobraking dynamic:

• For a given dynamic pressure, the uncontrolled motion in the phase plane is an ellipse centred on the equilibrium position

• As illustrated on the following figure, a limited impulse is sufficient to “re-enter” inside the deadband, while for a pure attitude deadband, it would have been necessary to reduce the rate to zero at a higher propellant expense (see Fig. 13)

  Fig. 13

  

  Control principle in AEBM

The AEBM is completed by a rate damping submode, engaged by TC in the timeline after the pass itself, this rate damping aims to reduce any residual rate under a threshold allowing direct transition to reaction wheel-based NOMR

The STR is kept powered “on” during AEBM but its data are not used and integrated gyro-data used instead to be immune to STR data corruption induced by aerobraking environment.

To ease operation, the reaction wheels can be kept powered “on” during the pass keeping their angular speed at constant value but are not used for control (furthermore, AEBM do not rely on the momentum bias of the wheels).

Minimization of the amplitude of oscillation relies on a proper initialization of the attitude (obtained by a NOMR slew) and a proper guidance profile during the pass (anti-velocity pointing)

Performances:

AEBM performances have been thoroughly analysed during robustness sensitivity analysis campaign (different type of orbit, different atmospheric uncertainties, initial condition errors, aerodynamic data base errors, etc.).

These simulations have allowed consolidating the aerobraking propellant allocation: ~6gr/pass (a 100 % margin is considered at system level). Figure 14 shows typical attitude and angular rate evolution during an aerobraking pass.

Fig. 14

Typical attitude and angular rate in AEBM

4.3 Periapsis time estimator (PTE)

From an operational point of view, the aerobraking timeline shall be loaded in advance.

However, the variability of the Mars atmosphere at aerobraking altitude (up to 100 %) induces uncertainty in the orbital period change and thus a growing uncertainty on the timing of the actual pass.

Large timing margin for acquiring and leaving aerobraking attitude are problematic from an energy balance point of view (solar arrays are not Sun pointed in aerobraking attitude). To overcome this difficulty, a prediction of the timing of the next periapsis is autonomously running on board (Periapsis timing estimator or PTE).

The principle of the PTE algorithm consists to estimate the time of passage at current periapsis by processing the acceleration sensed by IMU (determining the centroid of the acceleration profile). In addition, the Delta V imparted by the aerodynamic forces is also estimated by integrating the acceleration.

Using the two last estimates of the periapsis passage and the Delta period resulting from the aerodynamic Delta V it is possible to predict the timing (in On Board Time) of the next passage.

This prediction is used to shift the aerobraking operational timeline loaded by the ground segment.

The evaluation of the performances of the PTE implies multipass simulation.

A dedicated simulator has been developed to run the PTE all along the aerobraking period. This simulator uses reference trajectory provided by ESA-ESOC and a simplified modelling of AEBM control.

Figure 15 shows typical current periapsis estimation error and next periapsis prediction error along the whole aerobraking. (~11 months).

Fig. 15

Periapsis timing estimator (PTE) estimation and prediction error

(Between pass 400 and pass 930 aerobraking is interrupted to pass the superior conjunction—the periapsis is then raised to ~150 km).

These results show that:

• The estimation error increases at the end of aerobraking because of the low level of acceleration.

• The prediction error is maximum at the beginning of aerobraking because of the higher sensitivity of the period variation to the DV error.

4.4 Autonomous orbit raising in case of safe mode

While safe mode (SAM, NOMP) is designed to cope with an aerobraking pass, multiple uncontrolled exposition of the TGO to aerobraking flux is problematic. Furthermore, at the end of aerobraking orbit lifetime is an issue and long-term stay in safe mode is not possible.

To overcome this risk, the aerobraking safe mode sequence implements an autonomous orbit raising sequence (the so called “pop-up” manoeuvre).

The sequence relies on standard GNC commands and mode and is activated by the FDIR manager at the theoretical date of passage at apoapsis as uploaded by ground (i.e., not corrected by PTE output).

After the pop-up, regular safe mode pointing is restored and HGA is deployed and pointed towards Earth allowing high-data rate communication.

Autonomous orbit raising manoeuvre can also be triggered if an excessive acceleration have been detected during the pass or if the orbital period goes below predefined limits (orbit lifetime).

However, in these cases a lower amplitude boost is performed, allowing just reducing the flux and normal operation are continued.

4.5 Pop-up direction estimator (PUDE)

As mentioned earlier, the safe mode strategy in aerobraking relies on an automatic “pop-up” manoeuvre to raise the periapsis and limit the effect of the atmosphere; however, nominally the “pop-up” sequence requires a 3-axis reference and thus a working STR.

In case of long-term unavailability of both STR (in case of a major solar flare for instance) the TGO design offers the capability to perform a degraded accuracy “pop-up” manoeuvre using IMU data only.

It consists to integrate the deceleration sensed by accelerometer during the pass in an inertial frame maintained by gyrometer integration (the orientation of this integration frame wrt reference frame as J2000 remaining unknown).

This integrated DV is by nature close from the periapsis velocity direction and thus, parallel to the direction of a boost raising the periapsis (see Fig. 16).

Fig. 16

STR less pop up direction estimator (PUDE) principle

The PUDE algorithm have been tested during the MonteCarlo campaign to test SAM during aerobraking (various orbit, initial attitude, atmosphere dispersion), the estimation errors remains lower than 20° allowing a still efficient pop-up manoeuvre.

5 Failure detection isolation recovery (FDIR)

During most of the mission (including aerobraking) the FDIR is in so-called “fail-safe” mode meaning that serious anomaly results in transition to dedicated safe mode.

In case of anomaly detected at equipment level (level 1 of the FDIR hierarchical level), the concerned equipment is reconfigured and the current mode is reinitialized.

Safe mode sequence is engaged in others cases.

• Functional anomaly detected by S/W monitoring (level 2 FDIR), at GNC level: control error, RW overspeed, etc.

• SMU level anomaly (level 3 FDIR).

• System level hardware alarm (level 4 FDIR): battery undervoltage detected by PCU.

The safe mode sequence starts with a full SMU and equipment reconfiguration.

SAM is then engaged ending in any case to point −X toward Sun, simultaneously HGA and SA are driven to canonical position.

While in SAM spin submode STR is switched on, and the gyrostellar filter activated. As soon as the filter has converged NOMP is autonomously engaged.

At NOMP entering specific guidance data, stored in safeguarded memory, are loaded. This guidance data aims to point −Xsc toward Sun while Earth direction is in SC Xsc–Ysc plane.

If no previous failure on the RWS has occurred, transition to NOMR is autonomously done using the current reaction wheel configuration (except during aerobraking period), otherwise the S/C remains in NOMP.

In case of multiple safe modes triggering the transition to NOMP is no longer done and the S/C remains in SAM with low-gain antenna communication.

To support mission critical phase, the TGO can be configured in “fail-operational” FDIR, in this mode in case of level 2/level 3 FDIR triggers a full reconfiguration but the current mode is restarted instead of engaging safe mode. Obviously, minimum context data shall be periodically stored in safeguarded memory and reloaded at mode re-initialisation (a typical example is the already performed DV in an MOI boost).

During a main engine boost, the main engine shall be restarted within 10 s for thermal reason. As this duration exceed the initialization duration of central computer, start tracker and IMU, theses units are kept powered on during the whole fail op phase.

6 Development status

At the time of writing (May 2014) the ExoMars TGO GNC has passed its CDR (as part of the ExoMars system CDR).

The GNC design is completed and algorithm and tuning have been validated through an extensive robustness/sensitivity campaign.

The GNC application software have been coded and while it is undergoing S/W level validation, it has been retrofitted in GNC simulation environment for functional testing and preparation of reference run on avionic test bench.

TGO AIT process is going-on in Cannes, all GNC flight units have completed manufacturing and integration on TGO will occur in the next few months.

7 Conclusion

The design phase of the ExoMars GNC has been completed and the demonstrated performances meet the system level requirements.