Spacecraft Subsystem Operations

Schmidhuber, Michael; Löw, Sebastian; Müller, Kay; Scholz, Sina; Chatel, Franck; Faller, Ralf; Letschnik, Jürgen

doi:10.1007/978-3-7091-1803-0_6

Michael Schmidhuber⁴,
Sebastian Löw⁴,
Kay Müller⁴,
Sina Scholz⁴,
Franck Chatel⁴,
Ralf Faller⁴ &
…
Jürgen Letschnik⁵

3648 Accesses

Abstract

Chapter 6 describes the operation tasks of the various subsystems of a classic unmanned satellite in Earth orbits.

The first section deals with the Telemetry, Commanding, and Ranging Subsystem which allows the radio frequency transmission of remote monitoring and control information of a spacecraft. The next section describes the operations of the On-Board Data-Handling Subsystem, i.e., the spacecraft components that handle the on-board distribution and processing of data. The third section is about operations of the Power and Thermal Subsystem including energy sources, management, and storage for as well as heat sources, transfer, and dissipation. This is followed by a section on operating the propulsion subsystem including principles, configuration, real time, and offline operations. The last section, finally, depicts the operations of the Attitude and Orbit Control System.

Access provided by Autonomous University of Puebla. Download chapter PDF

Innovations in the AOCS of AstroSat spacecraft

Article 29 June 2021

Attitude and Orbit Control Systems

Attitude and Orbit Control Subsystem Operations

Keywords

These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

6.1 Telemetry, Commanding and Ranging Subsystem

Michael Schmidhuber

German Aerospace Center (DLR), German Space Operations Center (GSOC), Oberpfaffenhofen, 82234, Wessling, Germany
Michael Schmidhuber

6.1.1 Definition of Subsystem

This chapter deals with the operations of the spacecraft components that allow the radio frequency transmission of remote monitoring and control information of a spacecraft.

Although in many projects and system descriptions this function is handled as a subcomponent of the Data-Handling Subsystem, we decided to treat it here as a self-standing subsystem. Common names of it are TM/TC (Telemetry/Telecommand) or TCR (Telemetry, Commanding, and Ranging).

The subsystem as it is described below serves only the role of radio link and not of any processing of or insight into the transferred data which is done by the Data-Handling Subsystem (see Sect. 6.2).

This subsystem can also be used for orbit determination, a function that is commonly referred to as “ranging” or “tracking.”

The future prospect of optical communication is not covered here.

6.1.2 Signal Characteristics

A good and fundamental description is contained in Sect. 1.3; this chapter highlights only special aspects that are of interest for the TCR operations task.

6.1.2.1 Frequencies

Electromagnetic signals are typically divided by their frequency into ranges called “bands.” Refer to Table 1.3 for an overview of ranges and frequencies.

The frequencies used for a given spacecraft are selected by its corresponding communications requirements. S-Band (~2 GHz) is currently used mostly for low-earth orbiting spacecraft that transmit actively only over assigned ground stations, or for all space missions during their launch and early orbit phase. This comparably low-frequency band is suited for a relatively easy design of round-transmission signal characteristics. Obviously this is a useful feature in case the angle between the spacecraft antenna pointing direction and the direction towards the corresponding ground station (antenna aspect angle, see Sect. 6.1.3.2) is continuously changing.

It is also beneficial for contingency cases with uncertain spacecraft attitude, which does prevent an accurate antenna pointing. S-Band antennas are currently widely available around the earth at many ground stations which makes cooperations during LEOPs and emergencies easier.

X-Band (~8 GHz), Ku-Band (~12 GHz), and Ka-Band (~20–30 Hz) are using higher frequencies which result in higher possible data rates. These bands are mainly used during the routine phase of the spacecraft lifetime. Their bundled signal characteristic is used to avoid interferences and to save energy, but require exact pointing.

There is currently a tendency to shift operations to higher frequencies. This is partly due to pressure from other spectrum users (mobile ground communications) who want to use these bands for other applications and the fear of spacecraft operators of signal interference with increasingly crowded frequency regions. But mainly it is caused by the increased demand in telemetry downlink bandwidth.

The transmission of signals in high-frequency ranges like Ka-Band is highly dependent to atmospheric conditions and is thus affected by moisture and rain.

All frequency uses have to be coordinated with and approved by the ITU (International Telecommunication Union).

6.1.2.2 Polarization

Like visible light and any other type of electromagnetic radiation, radio signals can be polarized, which means that the direction of the oscillation is not randomly distributed, but follows a defined behavior. Two main types of polarization are distinguished: linear polarization and circular/elliptical polarization, as depicted in Fig. 6.1.

Both types of the phenomenon allow two independent ways of transmission on the same frequency: Two signal waves with perpendicular linear polarization can be considered as independent channels as well as circular/elliptical polarized waves with different senses of rotation. This can be used intentionally in communications, to make double use of a frequency. The receiving antenna has to be designed to filter out a selected polarization.

For stationary links the linear type is easiest to realize. For example, the polarization patterns of satellite television signals are either X- or Y- polarized. If receiver and transmitter antennas are likely to be rotated (or even rotating) around the signal direction, the circular polarization is used. Left-hand circular polarized (LHCP) and right-hand circular polarized (RHCP) can then be used to distinguish the two independent channels.

6.1.2.3 Side Bands and Side Lobes

Every antenna produces a signal not only in its main direction, but also generates side lobes, as depicted in Fig. 6.2.

Depending on the antenna design, these side lobes are weaker in strength and can normally not be used for signal transmissions. However, they may result in false receiver lock conditions during the phase of antenna alignment, as discussed below. See Sect. 1.3.3.1 for further details.

Not only in the spatial domain also in the frequency domain inadvertent side effects can occur.

If a carrier frequency is modulated by a signal, side frequencies are generated. They contain the signal information. The characteristic of this frequency pattern is dependent on the transmitter design (filtering). In the initial phase of frequency alignment strong side frequencies can lead to an incorrect receiver lock (misusing the side band as carrier frequency). The resulting demodulated signal is normally not usable as it is considerably weaker in strength.

6.1.3 Design

6.1.3.1 Subsystem Elements

The design of this subsystem is largely driven by the mission requirements and system details will rarely be identical on two spacecraft. But the main building blocks are mostly recurring. They are:

Antenna
Receiver
Transmitter
Routing and Switching unit

In the block diagram in Fig. 6.3, an uplink signal from the ground station is picked up by an antenna and guided to the receiver. There it is demodulated from the carrier signal. The resulting output is still an analog waveform. It is routed to the TM/TC Board of the on-board data-handling subsystem. This board is considered part of the data management system and is described in Sect. 6.2.2.1. Reversely the transmitter gets its input for the downlink from the on-board computer (OBC). It modulates it onto a carrier frequency and routes it to the transmitting antenna.

Some systems are designed to allow a direct signal connection between receiver and transmitter for the ranging function. This technique is rarely used in low-earth orbit (LEO) where angle tracking and GPS tracking are dominant, but is standard in orbit altitudes where GPS cannot be used (GEO/interplanetary). Ranging is explained in more detail in Sect. 6.1.5.2.

Antennas can be used for reception and transmission at the same time if interference of signals is avoided. This is done by using an uplink frequency that is different from the downlink frequency and by using filters in the signal paths.

The functional unit of receiver/transmitter is called a transceiver (transmitter–receiver).

For Payload data often a dedicated communications system, operating in a different frequency band is used (see Table 6.1 and Fig. 6.5). In case of scientific satellites this follows the same principles as described here. For communications satellites refer to Sect. 6.6.

Table 6.1 Examples of frequency usages for different types of satellite missions

Full size table

Figure 6.4 shows an example of a geostationary communications satellite TCR subsystem. The same data can be received and transmitted through any of the four shown transceivers. The S-Band systems are used as a redundant pair during LEOP and during emergencies. The omnidirectional antenna patterns make transmission independent of the spacecraft orientation. The S-Band receivers cannot be switched off to ensure they are available during emergency situations. The Ku-Band systems are used during the routine phase when the spacecraft is fixedly oriented to the earth. The antenna has a bundled characteristic that needs less energy to operate and does not as easily interfere with other RF signals. The Ku-band transceivers offer more functions like selection of different frequencies and some cross-coupling that is not shown in the figure. All four transceivers allow ranging, as this is the most precise orbit determination method available for geostationary satellites.

Communication satellites usually offer a beacon functionality to assist ground receivers in locating the satellite. This may be either a separated transmitter or one of the telemetry transmitters is used. This signal should to be permanently available.

In comparison Fig. 6.5 shows the TCR system of a scientific LEO satellite, based on the TerraSAR-X design. A ranging function is not used as the spacecraft can use GPS data for orbit determination. Only an S-Band system is used for real-time off-line data. The transmitter output power can be adapted to allow transmission with high data rates requiring more power and more exact pointing of the antenna to the ground station. The payload data system is separated and uses X-Band as an even higher data rate is needed for the payload data. A wide-angle pattern is needed on the payload antenna because the spacecraft is oriented along its orbital track and its attitude relative to the ground stations is therefore changing during passes. The payload antenna is nadir pointing.

6.1.3.2 Spacecraft Antenna Layout

Antennas can be distinguished by their transmission and reception characteristics, the so-called antenna pattern. It describes the sensitivity of the antenna dependent on the direction the radiation is coming from. It can either be directional or nondirectional (omnidirectional). The higher the frequency the more directional is the characteristic. Normally the pattern is the same for reception and transmission. Typically directional antennas provide a higher antenna gain and are used for routine tasks with high data volume. Nondirectional antennas are used for tasks that need to be robust against spacecraft attitude changes like in emergency situations or when no high rate data transmission is needed.

A real spherical, omnidirectional characteristic cannot be achieved with one antenna as the spacecraft body and the antenna structure will always block a significant part of the wave propagation. Therefore two antennas on opposite sides of the spacecraft body are used to form a spherical coverage. This is in particular the case on low-earth orbiting missions. Here, two S-Band antennas with hemispherical antenna patterns are used (Fig. 6.6).

When two antennas radiate the same signal on the same frequency and polarization in the same direction the signal quality will be significantly degraded due to interference effects. One way to avoid this is to design the patterns of the two antennas with a gap between them, causing a belt with no transmission as shown in Fig. 6.7 (left). This case is easy to implement and does not put additional requirements on the ground stations. However, if the satellite orientation causes the belt pointing in the direction of the ground station, the contact to the spacecraft will likely be lost or severely limited. Attitude and antenna aspect angle have then to be carefully monitored and considered for operational impact.

An alternative design is shown in Fig. 6.7 (right). The two antennas have wider angle of reception causing a significant overlap and thus transmission in all directions, but to avoid interference they emit and receive radiation with different polarization. This design produces no gaps, but needs a more sophisticated ground segment, being able to receive and transmit with two polarizations.

The two polarizations chosen for this design are typically LHCP and RHCP, as those are not dependent on the axial orientation of the antennas with respect to each other.

In some cases a complex overall antenna pattern is required. This can lead to designs with antenna arrays of more than 20 elements. Figure 6.8 shows the example of the Meteosat Second Generation spacecraft. The S-Band antenna is located on top at the spin axis and is of the type shown in Fig. 6.6. The L-Band antenna (~1.5 GHz) and the UHF (~400 MHz) antenna are composed of multiple elements pointing in radial direction. To avoid interference and unnecessary power consumption only the element pointing towards earth is activated [electronically despun antenna (EDA)].

6.1.3.3 Redundancies

To guarantee the function of the subsystem even after failures of components, more than one unit is supplied. Real redundancy is only reached when the backup component can take over the complete functionality. Complex electrical components like receivers and transmitters are therefore provided redundantly and independently, typically by providing a second system in parallel. Mechanical components like the antennas are very robust and are in many cases only singly available. A real redundancy is therefore not given. In these cases a limited redundancy can be reached by using other antenna systems like in the example of a GEO mission where a cabling problem during LEOP caused the complete loss of the Ku-Band system. The satellite was then operated in S-Band for the complete mission duration, without any loss of functionality, but with the negative effect of permanent omnidirectional S-Band radiation that caused interferences with other spacecraft.

Another example was the Galileo to Jupiter mission. Interplanetary missions typically have an omnidirectional low-gain antenna in addition to a high-gain main antenna that is folded for launch. In the case of Galileo the main antenna reflector failed to deploy. The complete mission was then handled with the low-gain antenna, causing higher efforts in on-board preselection and preprocessing and accepting a reduced data return.

6.1.4 Monitoring and Commanding

6.1.4.1 Automatic Gain Control

A central role in operations is the monitoring of the uplink Automatic Gain Control (AGC) level. The AGC is a circuit in the receiver that controls the signal amplification (or attenuation) to keep the signal strength in a defined range for subsequent components (Bullock 1995). The characteristic AGC parameter is the ratio of the signal level to an internal reference level. The term is used synonymously to the received uplink signal strength. The units are decibel; scale is logarithmic and negative. Typical values are between −50 dB (strong signal–low amplification) and −110 dB (low signal–high amplification) depending very much on the receiver type and the antenna characteristics. Values that are either far too high or too low may result in difficulties to demodulate the signal. If no signal (i.e., only noise) is received, very low values, e.g., −150 dB, will be indicated. Any remaining indicated signal level is caused by internal and external radio noise.

Operations shall be done only when the signal is in the range given by the manufacturer. It shall be planned ahead to either pause operations or switch over to another ground station with a better transmission situation.

The monitoring of the AGC level is important for successful operations. However the received signal level cannot easily be influenced. Therefore it is important to monitor the AGC evolution and make predictions about imminent development. For example, it is not advisable to perform commanding for an orbit maneuver over a station whose signal will become weaker or will be out of sight. An early switch to a different ground station should be considered. In some cases like an unusual spacecraft attitude, a boost of uplink power can be advisable.

6.1.4.2 Loop Stress

The signal is demodulated by a Phase Lock Loop (PLL) circuit in the receiver (Bullock 1995). This circuit generates a reference oscillation at the nominal frequency and compares it to the actually received signal. If the received signal is of exactly the same frequency, the loop is “in sync” or “locked.” If a difference is detected, then the loop circuit is able to adapt the reference frequency automatically within a certain range to eliminate the difference and establish the lock status. This offset to the nominal frequency is called loop stress. It is provided by the PLL circuit as a voltage and can be converted into kHz. It has limits beyond which the PLL cannot compensate the difference. In this case the lock status is lost, and the signal cannot be decoded. Note that the PLL circuit cannot follow very fast changes in frequency as it has a certain inertness to adapt the frequency. Nor can it detect and adapt to frequencies too far away from the reference frequency even if the signal frequency is within the allowed loop stress range. To still achieve a lock the ground station has then to adapt the frequencies of its transmitter.

The difference in frequency causing the loop stress can come from imperfect adjustment in manufacturing, shifts in oscillator properties both on the sender and the receiver side (temperature variations, aging). The largest part, however, is caused by the Doppler Effect due to radial velocities between sender and receiver. This part has a typical values between ±50 kHz for a low-earth orbiting spacecraft transmitting in S-Band when it appears at the ground station horizon. The variation of loop stress during a ground station pass is depicted in Fig. 6.9. A possible compensation for this effect is task of the ground station operations. Either a constant offset or a variable adaptation of frequencies can be applied to keep the loop stress within the limits and enable a successful receiver lock.

For interplanetary missions this effect can be much higher and the receivers have to be designed for this task. The interplanetary probe Voyager 1 is heading away from the sun at currently around 17 km per second. This causes an S-Band Doppler shift of ca −100 kHz. Finally a ±185 kHz due to the earth orbital velocity over the course of a year has to be considered. However, this Doppler shift remains largely constant over short periods. Only a small shift of ±3 kHz shift variation caused by the earth rotation is observed during ground station passes of a few hours.

6.1.4.3 Lock Status

As described above a lock status is necessary for the correct processing of the signal. Most receivers will indicate the lock status in telemetry. In other cases the status can be deduced from the AGC level and loop stress readings. It is worth noting that according to the ECSS-104 standard (ECSS 50-04C) a summary indication of the reception and lock status of all receivers is shown in the so-called Command Link Control Word (CLCW) telemetry. This flag indicates if at least one receiver is in lock. Since the CLCW has a fixed position in the telemetry transfer frames, it can be extracted from the telemetry stream by ground station equipment without complicated telemetry processing. Station personnel can use this to check successful uplink acquisition after an uplink sweep.

6.1.4.4 Polarization Prediction

Spacecraft that are not oriented to the earth (but e.g. to the sun) will have large changes in the antenna aspect angle (see Figs. 6.10 and 6.11) during a ground station pass. The antenna aspect angle is the angle between the ground station and the antenna boresight direction as seen from the spacecraft. This can result in bad reception conditions for the antenna/signal/polarization in use and a different polarization may be better suited for reception. However, although most ground stations can receive the downlink in more than one polarization (diversity), all stations uplink only in one polarization. A change of this polarization can take several minutes during which the contact to the spacecraft is lost and a new uplink sweep has to be performed. This situation can be anticipated if the TCR engineer makes a prediction about the expected polarization during an uplink period. The necessary calculation can be made easier if the antenna aspect angle is routinely predicted by the flight dynamics system for each ground station (see Sect. 6.1.5.1).

6.1.5 Operational Situations

6.1.5.1 Acquisition and Loss of Signal

An acquisition of signal (AOS) has to be performed each time a change in uplink is done, e.g., caused by a station handover. It is a task done by ground station personnel and under normal conditions no action is required from the TCR engineer. To ensure a lock of the spacecraft receiver, the uplink signal frequency is shifted up and down in small steps in the vicinity of the expected frequency. At one of these steps the receiver will be able to lock onto the signal and can follow further variations. This is called a “sweep.” However, as described above the station personnel check only if any receiver goes into lock and do not analyze the signal quality. It may happen that the satellite receiver goes into lock on a side band either in direction (side lobe) or in frequency (side band). This may produce a lock status, although the signal is not usable. It will result in a low AGC level (low signal–high amplification) and in case of a frequency side band a high loop stress. Uplinked telecommands can fail. A low AGC will also be seen in the ground received AGC and can therefore be detected by observant station personnel. If a situation like this goes undetected by the ground station, it is the task of the TCR engineer to inform the ground station and suggest a re-sweep.

The signal reception quality and strength are also affected by the operational situation. A major factor is the antenna aspect angle (Fig. 6.11). This angle changes for all satellites that are not earth-oriented and do not have steerable antennas. Depending on the antenna pattern the received and transmitted signal strengths are weakening when the angle becomes larger.

All transmissions are affected by atmospheric attenuation and refraction. This effect becomes very large and unpredictable when the signal has to travel large distances through the atmosphere near the ground station horizon. This is the reason why the time of loss of signal (LOS) cannot be known exactly. Operations planning shall take this into account and place critical operations into periods of stable reception.

6.1.5.2 Ranging

Ranging is a function that allows the determination of the spacecraft orbit. Unlike vehicles in lower earth orbits which nowadays simply use GPS to track their positions, satellites in higher earth orbits or on interplanetary cruise trajectories cannot locate their own position. Usually this is done using the ranging technique. Here the uplink signal is routed from the receiver directly to the transmitter and is radiated back to the ground stations. The on-board delay between reception and transmission time is exactly known and was measured on ground before launch. The ground station measures the signal round-trip time from which the distance between spacecraft and station can be calculated. Taking and processing the measurements are tasks of the ground station and the flight dynamics team. The impact on the flight operations team is that during the ranging period, roughly 5 min every 30 min for a GEO mission, no commanding shall take place in order to not distort the ranging signal. And also, depending on the transceiver model, the ranging function has to be switched on and off. Some receivers require after each interruption of the uplink to reset the uplink coherency function.

For interplanetary missions the impact is larger in that the ranging tones take away power from the telemetry signal which might be critical due to the weak signals coming from large distances. Also the operations pauses needed for ranging are considerably longer than for earth orbits (Bryant and Berner 2002).

6.1.5.3 Doppler and Coherency

Along with ranging, usually Doppler measurements are taken to improve the accuracy. The radial velocity component between satellite and ground station can be measured by determination of the frequency shift due to the Doppler Effect. For this method the downlink signal frequency has to be known precisely. As spacecraft usually have no highly stable oscillator on board, the self-generated downlink signal cannot directly be used for this purpose. In that case the uplink signal is used as frequency reference. Within the receiver, the downlink frequency is generated in a defined ratio (221/240 for S-Band) from the received uplink signal and thus becomes as stable as the ground station signal. This is called coherency.

Depending on the transponder model the coherency status may have to be commanded manually each time the uplink signal starts (or each time after the uplink was lost). In times without uplink the transmitter generates the frequency based on its own (imprecise) oscillator. A frequency jump will likely happen when coherency is started or stopped. This jump can be too fast or too far for the PLL circuit in the ground station receiver and can result in a loss of lock at the ground station. In that case telemetry will be lost and has to be reacquired.

Doppler shift, Coherency, and Ranging are normally used in parallel and the measurements influence each other. Ranging without coherency is possible and has been used in interplanetary missions (Reynolds et al. 2002). Also some geostationary satellites use this.

Interplanetary missions may actually use a highly stable oscillator at least during some mission phases like asteroid flybys in order to use Doppler measurements without the need for coherency.

6.1.5.4 Antenna/Transponder Selection

It depends very much on the design of the spacecraft if it is necessary to select the antennas used for transmission and reception. The less switching is involved the more robust the design and the simpler the operations. Mechanical devices like waveguide switches should be switched only if necessary and only without radiation load.

Typically receivers that are also used for emergencies are never switched off and are always able to receive over some antenna. Transmitters are usually only switched on if they are in use, to save energy and to avoid unnecessary frequency blocking. Only in contingencies these settings are commanded manually. Typically the commands are generated as part of the operational timeline and are automatically included.

6.1.6 Outlook to Future Developments

The future of the TCR subsystem and operations is predicted to lie in higher frequency domains and optical transmissions.

The proposed use of relay satellites may result in different antenna designs with steerable antennas that allow tracking of the relay spacecraft. The TCR subsystem may be supplemented by an optical communications system that also allows receiving telecommands and transmitting telemetry.

6.2 On-Board Data-Handling Subsystem Operations

Michael Schmidhuber

German Aerospace Center (DLR), German Space Operations Center (GSOC), Oberpfaffenhofen, 82234, Wessling, Germany
Michael Schmidhuber

6.2.1 Definition of Subsystem

This chapter describes the operations of the spacecraft components that handle the on-board distribution and processing of data.

This subsystem is here called on-board data handling (OBDH), although also other abbreviations are used. The terms OBC or satellite board computer (SBC) are sometimes used synonymously to OBDH, but strictly spoken they describe only the core computing component.

Often the TCR signal transfer components are encompassed in the definition of the OBDH subsystem; however, in this book they are described separately in Sect. 6.1.

In our definition the subsystem includes the TMTC (Telemetry and Telecommand) Board, the OBC units, and the on-board data distribution components. Although the design of the subsystem is extremely diverse between different spacecraft, it is also a showcase on how the use of international standards can commonalize the utilization of spacecraft.

6.2.2 Fundamentals

In the following we introduce the basic components of the OBDH in more details.

The examples given here are taken from a classical communication satellite series (Spacebus 3000 by Thales) and modern LEO scientific spacecraft (TerraSAR-X by Astrium and TET by Kayser-Threde, AFW, and DLR). They allow demonstrating the basic principles that can be found in some way on all unmanned spacecraft.

6.2.2.1 Subsystem Elements

Low-earth orbiting spacecraft nowadays add a GPS receiver for time synchronization and orbit measurements and a mass memory module to store large amounts of payload data. Also in many cases the AOCS (Attitude and Orbit Control System) software can be included in the main processor.

Figure 6.12 shows an example of an OBDH system. It contains a fictitious collection of components taken from a classical communication satellite series (Spacebus 3000 by Thales) and a modern LEO scientific spacecraft (TerraSAR-X by Astrium and TET by Kayser-Threde, AFW, and DLR). They allow demonstrating the basic principles that can be found in some way on many unmanned spacecraft. Actual implementations will use subsets and variations according to the mission requirements and dependent on the manufacturer’s design decisions. The components are explained in the following.

The TMTC board has the task to decode telecommand signals into logical structures, to transport them to their destinations and in the opposite direction to generate the telemetry signal out of the bits and bytes. It allows the isolation of dedicated command streams like high-priority commands (see next paragraph) and it contains authentication functions (see Sect. 6.2.3.4). Information about the result of the telecommand execution is merged into the telemetry stream along with the standard telemetry coming from the OBCs. The board is usually implemented as firmware running on robust and fast hardware. The generic design is standardized and largely independent of the spacecraft. The main standards for telecommand and telemetry are coming from organizations like CCSDS (Consultative Committee for Space Data Systems), ISO (International Organization for Standardization), and ECSS (European Cooperation for Space Standardization) formats.

Not all telecommands are processed by the OBC. Low-level commands are already handled by the TMTC Board. They serve very basic functionalities like switching of OBC to backup that have to work even in emergency situations. The TMTC Board includes a logic that allows a limited number of these commands. This is called Command Pulse Distribution Unit (CPDU). The pulses are forwarded to their destinations via dedicated cables. Also devices that need a higher electrical current than can be provided by normal data lines use this mechanism. Therefore they are also called “high-power telecommands.” A common example is the ignition of pyrotechnical devices that may release a folded antenna structure. The according command pulse needs a specified duration. This can is usually a settable command parameter. In case an HPTC command is not successful it may be helpful to increase the pulse duration. It is not possible to time-tag HPTCs.

6.2.2.1.1 On-Board Computer

Sometimes also called the Processor Module (PM), the OBC is a programmable computer that contains the satellite-specific software to manage complex spacecraft functions. Some functions may be located in dedicated, separated units: In Fig. 6.12 the attitude control functions are implemented in a separate computer module (AOCS Computer).

All software can potentially contain programming errors or may require updates, e.g., to adapt to deteriorating hardware. Therefore mechanisms are implemented that monitor the activity of the OBCs (see Sect. 6.2.4.2) and that allow uploads of new software (see Sect. 6.2.4.3).

Additional modules like a safeguard memory (SGM), mass memory units, and Reconfiguration Modules (RM) are located in close vicinity around the processor modules. They are described in Sect. 6.2.4.2.

6.2.2.1.2 Mass Memory Unit

Only spacecraft with permanent, reliable ground contact can be designed without extensive data storage capability. Interplanetary probes and low-earth satellites need to store data until it can be transmitted to ground. Nowadays solid-state memory units have replaced devices like tape recorders that have been used in earlier times. These memory units can be attached to or integrated in the OBC or they can be located next to payload instruments. Figure 6.12 does not show a mass memory device as a geostationary satellite is displayed. More detail can be found in Sect. 6.2.4.5.

6.2.2.1.3 Data Bus and Data Cable Harness

Most spacecraft use a data bus system for communication between the OBC and remote devices. Standards like MIL-1553 are used as protocol. Selected data may be transported over dedicated cabling to the OBC if it is of special importance with regard to safety or robustness or if the remote unit does not support the bus protocol. Remote Data Units (RDU) are used to connect sensors and actuators to the bus.

For telecommands it shall be noted that some commands are converted into electrical pulses that are transferred via dedicated cabling. These are the high-priority commands that are generated by the TMTC board as described above.

6.2.2.1.4 Additional Components

Low-earth orbiting spacecraft include a GPS receiver for time synchronization and orbit measurements. Note that GPS reception is conventionally only possible in orbit altitudes of up to 7,000–8,000 km above the earth. Nevertheless modern geostationary satellites also include GPS receivers for use in the transfer orbit, and with limitations also in the geostationary orbit.

In classical geostationary communication satellites usually the AOCS software has its own processor located in a remote device.

Other remote devices can be used for functions like power distribution and data bus interfacing.

6.2.2.2 Redundancy

Due to its key function, usually the OBDH system has a redundant layout. This means that all components are doubly provided to protect against failures. Depending on the design of the spacecraft, redundant devices may be switched off or may be set to a standby mode. In any case at least the redundant TMTC Board is powered all the time as it must be immediately able to take over the telecommand reception from the active board.

The redundancy concept requires careful balancing of costs and risks. It is quite common that not each and every function is fully and independently redundant, the latter one meaning that e.g. a given redundant fuel valve can only be controlled (including telemetry) from the redundant OBC, but not from the prime one. This reduces significantly the complexity of the system and thus the costs, but is also reducing the redundancy level: If the redundant fuel valve needs to be used, also the OBC has to be switched over and consequently loses its redundancy as well. Those limitations have then to be considered for the in-orbit test (IOT) campaign and also for the contingency procedures.

In technology demonstration projects more complex and advanced layouts have been tested. For example the satellite TET has a layout with two pairs of computer units that monitor each other and can swap the roles of “worker” and “monitor.”

Usually the redundancy is intended for safety purposes. However, in some cases the redundant units can be used for additional activities like generating a second, independent telemetry stream.

6.2.2.3 Telemetry Parameters

The elements that contain information about the spacecraft and that shall be transmitted to ground are called the telemetry parameters (sometimes also called telemetry points). They can contain status information (like ON/OFF flags), numerical data (like temperatures or counters), or binary data (unstructured). Their value or meaning has to be coded into a binary format. In most cases it is important to save bandwidth and therefore the smallest possible coding is used: Flags can be 1-bit values; the length of the bit pattern of integer numbers depends on the value range of the corresponding parameter. Measurement values either use an interpolation table or use a standard real number format like IEEE 754. The coding used is described in the spacecraft database.

6.2.2.4 Telecommands

Telecommands are the instructions that allow controlling the spacecraft from ground. They are also defined in the spacecraft database. A telecommand has an identifier and it may have a number of command parameters that modify or specify their behavior. Commands may switch devices, set values in registers, or transport a binary data segments.

An important part of the commands is the “address” part that describes which part of the OBDH shall receive the command. This is described in Sect. 6.2.3.5. The remainder of the command is the command data. It is composed of the before-mentioned command parameters and the command identifier.

6.2.2.5 Spacecraft Database

All the information on how the commands are packed into the uplink stream and how they are decoded from the downlink stream are defined in the spacecraft database. Among its elements is the complete set of available telecommands, the complete telemetry item set, the definition of packets or frames, respectively, or the scripts running on board. It contains in most cases also so-called derived parameters. These items are treated like telemetry, but their values are basically result of ground system calculations which use telemetry or ground processing information as input. The formulas behind the calculations are usually developed by the flight team according to information by the manufacturer and added to the database.

For telemetry parameter limit values can be defined in the database. Violations of these limits can be indicated in the telemetry display system with a visual or audible alarm notification, but it can also be checked later on in an off-line system [e.g., for dumped telemetry that was not processed by the real-time Monitoring and Control Software (MCS)]. An alert staging is possible when additional limits are provided that raise only prewarnings. Multiple limit sets can be provided that allow adaptation of limit values to different mission phases. “Summary alarms” can be defined that indicate a violation of any of its assigned parameters. This is needed to monitor modern spacecraft that typically have myriads of telemetry parameters.

The database can also contain information like flight procedures and telemetry display pages. Due to its central function for the manufacturer during the preparation and for the operations team during the mission the database is also called Mission Information (Data-)Base (MIB) or Mission Data Base (MDB).

The database is created by the manufacturer and is on the one hand embedded into the spacecraft computer software and on the other hand provided to the control center in an agreed exchange format.

The operations team needs to validate its ground system and operations using the database. The operations team should ideally give feedback to the spacecraft manufacturer about the usability of the database. A frequent issue is the naming convention of parameters and commands. Each entry, telecommand, or telemetry point is identified by a unique database identifier.

For operational safety it is important that the naming of parameters is done systematically and ergonomically and from an operator point of view. This can differ considerably from the perception of the manufacturer.

For example, sometimes mnemonics are assigned to the telemetry parameters that are very long and of different length. This makes flight procedures and telemetry display systems cluttered and confusing. A good operational mnemonic has between 5 and 10 characters and follows a stringent systematic. An early dialogue between control center and manufacturer is advisable to reach a common approach.

During a mission the database is normally updated to include new functions, correct errors, or react to unplanned events. However, it is of highest importance that the versions of the database on ground, on board, and in the documentation are identical. Therefore strict and formal change processes and configuration control are required.

6.2.3 Space to Ground Data Streams

6.2.3.1 Data Transport

For both uplink and downlink data is transported in transfer frames. We will explain the principle mainly at the example of telemetry. The telecommand transmission works similar.

All data streams consist of very long series of bit values. This stream is structured into successive pieces of equal length called transfer frames. All transfer frames start with a non-changing “sync pattern” that allows the receiving station to recognize the beginning of a transfer frame even after interruptions. The transfer frames also contain header information that indicates the transfer frame size, a frame counter and a virtual channel identifier (Sect. 6.2.3.5). The frame trailer contains a checksum [cyclic redundancy check (CRC)] that allows detecting transmission failures. Typical examples are provided in Fig. 6.13. Standard sizes are 1,119 bytes for telemetry and 256 bytes for telecommand streams.

6.2.3.2 Frame-Based Telemetry

This type of telemetry is sometimes also called PCM (Pulse Code Modulation) telemetry format.

The telemetry parameters are assigned and distributed to a set of several different “minor frames.” These are of a fixed length and fill a transfer frame completely. The different minor frames are transmitted one after the other and repeated cyclically. Each minor frame has a header that contains the frame ID to allow identification. The complete set of minor frames is called “major frame” or “format.”

Figure 6.14 shows an example for a minor frame. Telemetry parameters are assigned to certain positions within the available data space as defined in the spacecraft database. The coding of the parameter values depends on its use and can occupy any number of bits. Mostly the parameters are grouped into and aligned to data chunks of 16 or 32 bits called words or double words.

If each telemetry parameter is assigned to only one minor frame then all values are transmitteed only once per major format. However, it is possible to assign important and especially dynamic parameters to multiple or even all minor frames as shown in Fig. 6.15. In that way it is tried to balance the importance of the parameters with the available bandwidth. This rigid scheme can, however, not be sufficient for all operational situations. To overcome this, it is usually possible to dynamically redefine some areas during flight and thus change the selection and the sampling rate of telemetered values, which leads to various improved methods and concepts like dwell, dump, pages, oversampling, and subsampling.

Frame telemetry is a basic method that allows transferring data in a simple way. It was employed since the early days of spaceflight, but is being superseded by packet telemetry (ECSS 50-04C 2008) since the late 1990s and beginning twenty-first century by packet services like described in the ECSS PUS (ECSS 70-41A 2003), which are discussed in the following chapters.

6.2.3.3 Packet Data Structures

The increasing demand for higher data rates and more telemetry parameters as well as the general tendency to include more software functions in spacecraft design led to the need for more flexible and efficient data transport methods. A prominent example is the CCSDS packet telemetry and command standard (CCSDS 133.0-B-1). This standard implements many modern mechanisms of data transfer.

In this concept the parameters and commands are grouped into logical packets. Any number of packet definitions can be stored in memory. Their size can vary up to 216 = 65,536 bytes (octets) (Fig. 6.16).

The packet header contains information that allows identifying the packet and its length.

The data stream itself is still organized in frames of fixed length, which act basically as containers for the packets. As shown in Fig. 6.17 each frame contains a small element called segment, which can be considered as a management layer for the packets. It allows to multiplex several packets (or packet parts) of any length into the frame structure and thereby to distribute the bandwidth capacity among several destination devices. The telecommand segment layer can contain a sublayer for authentication. In that case an authentication trailer is added after the segment and thus the packet size is reduced. The authentication is handled by the TMTC board of the spacecraft. It protects against illegal commanding of the spacecraft.

Telemetry packets can be organized such that they are generated at a fixed rate or on request or on event. For example, command execution confirmation (or rejection) messages will be generated on event. The processing of packets is performed by the OBC and puts a relatively high load on it. It has to provide the mechanisms for buffering and organizing the telemetry stream. The frame and segmentation layers are handled on hardware level inside the TMTC board.

Telemetry packets can be switched off or on, they can be sent with different data rates—depending on the current operational situation, which makes this telemetry concept very flexible and efficient, but also complex and not very transparent.

Again, the definition of the various packets is contained in the MDB.

6.2.3.4 Packet Utilization Standard

So far we have described how information is transported, but not how it is handled on application level. To achieve a uniform approach to spacecraft control, the concept of service types was defined by ECSS in the Packet Utilization Standard (PUS) (ECSS 70-41A 2003). The idea is to not randomly write data patterns to (TC) and read others from (TM) on-board registers and interpret the result in a mission-specific manner, but to rely on standardized services for this.

These defined services are much more far-reaching than the classic TMTC tasks, which may (a little impudently) be summarized as

Send a telecommand to a destination
Load telecommands to the time-tag buffer
Send telemetry to ground
Configure telemetry

The services defined in the PUS now cover a vast field of data management functions, reaching from memory management to time distribution. However, not only standard services are defined in the PUS, but there is also room for mission-specific definitions.

This approach ensures that the manufacturer/the mission can tailor the standard for their implementation. A possible negative result is that it may happen that manufacturer-specific solutions of basic tasks may be implemented in private services and are effectively undermining the standardization.

The list of defined services in Table 6.2 shows that on the one hand the tasks are now grouped into various aspects but on the other hand it makes clear that also very advanced concepts are included that previously were only present fragmentarily or not at all. An example would be service 4 that allows statistical information about on-board data to be requested in a formal way. The service defines the necessary data structures and functions. In that way manufacturers and operators are “coaxed” towards thinking about advanced concepts. The hermetic art of spacecraft control now has an open language. Like before, however, implementing advanced services may produce a large development effort on the manufacturer and may therefore be avoided, or tailored. Standardization will make the reuse of ground systems easier, in the long run also for space systems.

Table 6.2 The currently defined standard PUS services

Full size table

6.2.3.5 TMTC and Security Management

6.2.3.5.1 Flow Control Mechanisms

This function is used to assure safe operations by protecting against faulty transmission of data. The first measure is to include error control and forward correction information. This is done on low level (coding and transport level) and cannot be modified during operations. The keywords are CRCs (cf. Sect. 6.2.3.1) and randomization (a deliberate coding of data to assure bit synchronization). The operational tasks are limited to configure the MCS on ground to accept or reject faulty telemetry frames for diagnostic purposes and to monitor the uplink frame quality that is reported in low-level telemetry generated by the TMTC Board.

The second measure is to introduce a quality of service (QOS). This is used to recognize and recover data lost in transmission. The basic means for this are counters. Frames and packets carry counters that are tracked and checked for gaps.

In the uplink channel this can be a closed-loop process by using the COP-1 protocol as described in ECSS 50-04C (2008). This mechanism is implemented on transfer frame level. The control center can choose to transmit either in AD (“acceptance”) or in BD (“bypass”) mode. Simplifying a little bit, in AD mode the commanding process waits until it receives the uplink confirmation of the previous command before it transmits the next one. Some MCSs allow an automatic retransmission of lost commands. Apart from synchronization tasks the command link is not necessarily slowed down compared to the BD mode if the “sliding window” mechanism (ECSS 50-04C 2008) is applied where a settable number of frames is uplinked before the confirmation is received. Obviously the AD mode can only work if telemetry is available. For blind transmissions or unstable connections the BD mode has to be selected.

This mechanism is called FARM (Frame Acceptance and Reporting Mechanism) (ECSS 50-04C 2008) and is done on low level in the TMTC Board. For telemetry no such mechanism is standardized. A possible retransmission has to be done on MCS application level or manually initiated by control center staff.

6.2.3.5.2 Routing Mechanisms

The established standards allow to precisely address source, destination, and the route of telecommand and telemetry data units. ECSS (ECSS 50-04C 2008) defines the following qualifiers:

The Spacecraft ID (SCID) is a worldwide unique number that protects against uplink signals intended for other spacecraft (sana 2014). It is important to note that simulation systems, engineering models, etc. usually have separate IDs. The correct selection may be a source of problems during the switch from simulation to the mission.
The virtual channel (VC) ID in the uplink path distinguishes if a signal is intended for the prime or the backup decoder (TMTC Board). Only the addressed decoder will forward the command. Note that this flag is set in the ground command system. Normally it is independent from the spacecraft database and should be easily changeable. In the downlink the VC allows to interleave different data channels that may be processed by separated ground systems. The low-level implementation allows separating the channels without knowledge about the spacecraft database. This is commonly used for data dumps (Sect. 6.2.4.5) that are processed on ground in a different way or by different control centers.
The multiplexing access point (MAP) ID is analyzed within the TMTC Board and directs the command to different devices. Usual destinations are the CPDU (high-priority telecommands; see paragraph below), the Authentication Unit, and the prime and backup OBC. Most telecommands will be accepted only at a specific destination, but in the case of OBC MAP IDs this can be used for addressing the backup OBC over cross-strapped connections (Fig. 6.13). Like for the virtual channels, this parameter can usually be set dynamically in the MCS. Alternatively backup commands can be defined in the spacecraft database for this purpose.
The Application ID (APID) is used to specify the destination on packet level. It is evaluated by the OBC.

6.2.3.5.3 Authentication

Another mechanism that is located inside the TMTC Board is the authentication. This is used to ensure that only the legitimate control center can control the spacecraft. The uplink stream is usually not encrypted, but encrypted signatures are attached to the segmentation layer. The signature includes an encrypted counter to protect against replays. A set of secret emergency keys is implemented into the authentication device on board and it is possible to upload more keys for daily usage. There are special telecommands available to control the mechanism.

Flow control, routings, high-priority commands, and authentication mechanisms are nicely described in MA28140 Packet Telecommand Decoder (2000).

6.2.3.5.4 Encryption

For military spacecraft, but also increasingly for civil applications, it has become usual to encrypt either the complete or parts of the data transmission. There needs to be an encryption device and a set of keys on board. To enhance the protection the keys have to be changed in regular intervals. It depends on the implementation how this is exactly handled and even where the encryption device is located inside the OBDH. Two main usage scenarios are common:

Encrypt the complete data stream. The en-/decryption on ground side takes place in the control center.
Encrypt only payload data. The en-/decryption on ground side may take place in the user center. This may even be done with multiple users where each user has his or her own set of keys and can only extract his own data.

6.2.4 OBDH Management

6.2.4.1 General

Operating the data-handling subsystem is under normal conditions mostly embedded into the routine mission tasks. During mission preparation and in case of anomalies or special campaigns, however, the complexity of modern spacecraft makes this a broad and demanding field. The work related to the spacecraft database tasks mentioned in Sect. 6.2.4.3 may occupy several persons including the data-handling expert. During mission preparation the MCS of the control center needs to be adapted; a task that is heavily connected to knowledge about the OBDH system. During mission execution the functions of the MCS needs to be understood to fully make use of the spacecraft abilities, especially during non-nominal situations. In the following chapters the basic operational tasks related to the OBDH are explained.

6.2.4.2 Safeguard Mechanisms

6.2.4.2.1 Fault Detection, Isolation, and Recovery

To protect a spacecraft from damage or loss of mission, usually fault detection, isolation and recovery (FDIR) mechanisms are provided where a robust supervising unit monitors a functional unit. It is vital for safe operations to understand this mechanism and to be able to interpret the telemetry correctly and quickly as the knowledge is mostly needed in critical situations.

The FDIR functionality may be spread over several components like the reconfiguration module (cf. Sect. 6.2.2.1) and the OBC. The layout will be different for each satellite platform using different approaches and levels of severity. Functionalities can be installed using hardware or software or both. Usually failures that are not threatening to the spacecraft health are not handled autonomously and are left for ground (control center) interaction. Errors that can be corrected by the unit itself are usually reported but otherwise ignored by the higher level FDIR, e.g., the EDAC (error detection and correction) correction of memory bit flips using available redundant information. This philosophy is, however, currently changing with the availability of event action services like described in the PUS (ECSS 70-41A 2003).

Basically FDIRs are monitoring system properties (telemetry values, bus voltages, hard-wired signal inputs, keep-alive signal, etc.) for deviations beyond allowed limits, report about the incident and execute a predefined action: The surveillance defines a list of one or more health check parameters (HCP) taken either from normal on-board telemetry buffers or from dedicated signal lines. Their values are monitored with a dedicated frequency (e.g., with 1 Hz) and compared with defined and possibly configurable thresholds.

Depending on the device and its criticality, a single or repeated (after n consecutive) parameter limit violation of one or more parameters (e.g., majority voting) then triggers the FDIR situation and the corresponding action, e.g., to switch to a redundant device.

This occurrence is usually registered in some kind of error log, but in some cases it has to be deduced by the ground team from the telemetry: In emergency cases, the memory including the log could be erased by OBC reboots, telemetry was not set to be recorded or there was no ground visibility. For this reason e.g. geostationary satellites configure their telemetry to send out the error log file continuously. In the worst situation, the error log file might be the last signal the control center sees from the spacecraft.

Usually it is possible to configure the monitorings and actions of the safeguard mechanisms. In some cases notifications shall be issued, but no action be triggered. If redundant equipment is activated by an FDIR, usually there is a different and limited FDIR on the redundant device. This shall usually stop the system from switching back to a presumed faulty prime equipment in case of a second or persisting external trigger. For certain operational tasks is necessary to disable some FDIRs (e.g., during an orbit maneuver). This will typically be covered by the according flight procedures.

The recovery actions can consist of one or more discrete steps. It is common to use some “macro” functionality, releasing a sequence of individual commands on board. This can again be implemented as software (potentially as On-board Control Procedure wrapped into a PUS service cf. Sect. 6.2.2.4) or hardware. The device for the latter case is called a reconfiguration module (RM). (Electro-)mechanical registers send out command signals over dedicated cables. Software macro command mechanisms usually use standard command packets (like the ones sent from ground).

Table 6.3 shows an example for an emergency macro command sequence of a geostationary satellite. In many emergency situations the spacecraft is put into a stable safe mode by the AOCS computer. This mode is called sun acquisition mode (SAM) because it reorients the spacecraft to the sun and starts a rotation around this direction. A FDIR mechanism inside the OBC detects this mode and adapts the satellite to the new situation. The shown steps are executed. The real sequence contains more than 50 discrete commands and delay statements. If redundant commands are available both are used to make the sequence more robust.

Table 6.3 The main steps of a SAM macro command sequence

Full size table

The recovery sequences are reprogrammable. But this option is used very rarely; usually this is the domain of the manufacturer. Changes should be done only cautiously and after consultancy of the spacecraft manufacturer. The correct content of the sequences should be checked regularly, however.

The operational tasks are to monitor for occurrence of an FDIR. This day-to-day supervision can largely be handled by automated telemetry alerts and configuration checks (concheck). Note that for LEO satellites the telemetry checks have to be done off-line, as large parts of the telemetry are stored on board and are dumped in compressed format. They have to be unpacked and processed on ground. This is mostly done in separated off-line data processing systems.

6.2.4.2.2 Safeguard Memory

The components and the software used for spaceflight applications are very durable and well tested. The FDIR mechanisms and the redundant layout add to this. Nevertheless it can and will probably happen during the life time of a spacecraft that the OBC has to be restarted either by ground command or after an anomaly that triggered an according FDIR.

Like for normal PCs the RAM memory is cleared during a restart. The OBC software will be loaded from a PROM or EEPROM and is configured for a default standard spacecraft configuration (typically the launch configuration). The configuration set contains items like momentum wheel selection, redundant device selection, etc.

If during the mission a redundant device was activated due to failure of the prime equipment, then the default software configuration does not take this into account, which may lead to another triggering of the reboot or to a dangerous situation for the spacecraft. Therefore a device is included in the design of the OBDH called SGM. This is a protected register. It will not be erased during power failures and is especially guarded against radiation of other environmental influences. From this memory the OBC can take current settings that may be different than the default settings. Depending on the complexity of the spacecraft this can be a few fundamental setting or elaborate data areas. Configurations that are relevant on hardware level may be stored in electromechanical configuration relays. This may be the on/off status of the authentication mode of the TMTC Board.

The content of the SGM has to be updated after each relevant reconfiguration of the spacecraft. The according activity is normally part of the flight procedures. Depending on the abilities of the OBC it may be a tedious, time-consuming task. Nevertheless the update shall not be delayed too long. After the update it is good practice to dump the SGM content to ground in order to check the correct writing. Also the operations team should have enough information to interpret the content of the memory dump. The possibility to change the content of the SGM is protected and special commands are needed to allow and afterwards disable write access.

6.2.4.3 On-Board Software Maintenance

6.2.4.3.1 Modifying the Mission Database

Two different aspects of the Modifying the Mission Database (MIB) have to be considered: the spacecraft implementation and the ground implementation. Of course both have to be coherent at all times. Nevertheless it is not necessary to update the on-board version each time the ground version is changed, since the on-board part can be considered a subset of the ground MIB, as explained below.

The on-board side has the task to define how to unpack telecommands from the uplink stream and to which destination device to forward them to. A possible change might be to reduce the list of accepted telecommands. This can be a measure to protect against unwanted commanding from ground. Also a change of the interpretation of telecommands is possible, however, only in conjunction with an OBC software update. For example when the on-board software for time-tag register management is updated, potentially the new software is able to accept new telecommands; the on-board database needs to be updated to accept the new command pattern.

The most common change, however, is the change of the definition of telemetry packets. This is expected to happen mostly for new spacecraft without sufficient operational experience where the initial definition may need to be adapted after a while or after anomalies or failures when the existing observability may not be sufficient. Since telemetry packets can be very long and may consume a large portion of the bandwidth, it may under certain circumstances be better to define a small diagnostic telemetry packet for the particular situation that can be then sent down at high rates.

In all cases the ground database has to be updated accordingly.

Mostly the on-board database is implemented as integral part of the on-board software and is not modifiable separately. Some aspects like new TM packet definition can be modified using PUS service 3 (Reporting Service, cf. Sect. 6.2.3.4). The persistency of updates and service requests after OBC reboots has to be checked.

The ground system database implementation includes many aspects of the ground system that are adaptable and do not affect the space side:

Including commands, which are already available on board, but were originally not allowed for the control center
Introducing new commands that are just redefinition of complex, already existing commands with many specific parameters into a simple short command or that allow only a reduced parameter range
Modifying the calibration of parameters (e.g., status texts) for telemetry items or telecommands
Adapting the telemetry ground limit entries
Introducing or modifying derived parameters or ground parameters (e.g., ground station telemetry)
Introducing telemetry parameters for improved and safer operability (e.g., define the bits of “status words” as separate parameters giving them text calibrations)
Modifications of display page definitions or command sequences that are embedded in the MIB

Mostly the changes have to be coordinated with and agreed by the spacecraft manufacturer. Strict versioning and configuration control should be in place. Changes have implications on the flight procedures and the documentation. The effort can be considerable. Database tools can help in keeping flight procedures and the database consistent.

Whether the modification of limit entries (alerting thresholds as described in Sect. 6.2.2.5) in the active MCS during run-time is allowed under configuration control is debatable. Depending on the work practice established at the control center and especially for geostationary satellites a relaxed approach is possible. Remember that the alert mechanism mainly serves the purpose of situational awareness for the first-line operator. It may make sense to adapt the limits temporarily to avoid flooding the operator’s attention. A compromise is to use temporary database overwrite mechanisms during run-time of the MCS system. This preserves the original database in the configured installation. This situation should be cleared during the next regular database update. Database modifications are considered critical and should be tried on a test or simulation system beforehand.

6.2.4.3.2 OBC Software Maintenance

When the manufacturer provides a new software version for the OBC, the necessary operations tasks are the uplink of the software data, the management of the software image on board, and the boot process.

Typically the software is split into smaller parts and embedded into data transfer commands. All uploaded data has to be checked for completeness and correctness when it is reassembled on board using checksums or by dumping all data back to ground with subsequent comparison with the original one. The software then needs to be transferred to the memory area of the OBC that will be used during the boot process. It is important to make sure that the original software can still be accessed in case there is a problem with the new software during the boot process that makes it impossible to communicate with the spacecraft. There are several possible methods to prevent this and the spacecraft manufacturer has to provide a corresponding procedure. When the first boot and the IOT of the software were successful, the new software needs to be configured as permanent boot software.

All these aspects can be handled by advanced memory management services like provided by the PUS or by using conventional telecommands.

6.2.4.4 Execution Management

6.2.4.4.1 Time-Tagging

Telecommand time-tagging is used to issue pre-loaded commands at specific times when either the spacecraft is out of sight of a ground station or there is the possibility to lose the command link to the spacecraft, or when exact execution timing is required.

Nearly all telecommands can be time-tagged and the ECSS Standard (ECSS 50-04C 2008) provides a method for it. Excluded from this are the hardware decoded high-priority telecommands that are handled by the TMTC Board. If a Time-Tagged Telecommand (TTTC) is received it is captured by the time-tag software (or schedule handler for the PUS spacecraft) and put into a memory table. This table contains the defined execution time and the actual telecommand. When the on-board time equals the execution time the command is released to its destination. The time-tag table (or schedule) can have restrictions and peculiarities. In some spacecraft it is possible to have more than one TTTC for the same execution time. Some spacecraft allow only adding time-tags to the end of the list and in chronological order, thus forcing complete deletion and resending of all TTTCs when a new one shall be inserted in the middle. Some designs use register numbers to store and address memory locations.

The extent and scope of usage depends on the mission needs. A geostationary satellite has nearly permanent ground contact and needs time-tagging only rarely:

To put potential rescue commands a little into the future to protect against possible lockouts in the uplink path (including ground failures). These TTTCs will usually be erased or updated when no contingency occurred
To ensure nominal commanding to protect against loss of uplink signal
For precise timing of commands (a rather rare thing on classical communication satellites)

Consequently geostationary satellites need to store only a small number of time-tagged telecommands (less than 100).

Low-earth orbiting spacecraft with only few ground contacts or interplanetary missions with long signal propagation times depend heavily on this capability. Therefore they have hundreds or thousands of slots for TTTCs. Two aspects are of special importance here:

To switch on and off the ground link (telemetry) during the predicted contact times to optimize the available contact time. An example case is described in Sect. 6.1.5.4.
To control the payload. This can be the timing of payload operations and payload data collection.

The mission timelines of LEO satellites and interplanetary probes are rather complex. The rudimentary operations provided by earlier spacecraft platforms were making operations very demanding. For this reason the PUS service 11 (Scheduling, ECSS 70-41A 2003) introduced advanced methods for this. This standard foresees to define subschedules than can be activated, edited, time-shifted, and deleted separately. It is even possible to interlock schedules providing a way to make progression to the next TTTC dependent on the success of the previous step and so on.

To keep track of the schedule activities it is recommended to use a ground tool that models the schedule and can compare this model with a schedule dump during the next visibility period. Also advanced ground systems allow matching stored and dumped command execution confirmation (or rejection) events with the telecommand history of the command system and displaying any mismatches.

The time-tagged commands and the schedule are of course dependent on an available time-source on board. If the time becomes unreliable for any reason (e.g., an OBC reboot), then the time-tag registers will be erased.

6.2.4.4.2 On-Board Control Procedures

Advanced spacecraft allow storing complete sequences of commands on board. This is similar to the schedule mechanism without a predefined execution time. The procedures remain in memory and can be reused and adapted. This can reduce the bandwidth demand in the uplink channel drastically, when repeating procedures are very long and only a few key parameters have to be changed. Again the PUS standard has a service for this (PUS 18). Together with event monitoring and action services (PUS 5, 12 and 19) it gives the spacecraft a high degree of autonomy.

6.2.4.5 Mass Memory Management

The management of mass memory storage devices is of concern mainly to missions in LEO or on extraterrestrial missions that have to store payload data.

In earlier times data was typically recorded on tape recorders e.g. for the Voyager mission to the outer solar system. Only in rare cases mechanical hard disk memory drives were used (Bussinger et al. 1993). In recent times the predominant design is to use solid-state memory.

Different storage concepts have been devised.

6.2.4.5.1 Ring Buffer

A ring buffer is a robust and simple mechanism. That is ideal for continuous data streams that can be expected to be cleared in a predictable regular interval and also when their handling character is FIFO (first in–first out). Here the physically available (linear) storage is modeled in ring shape and thus creates an apparently infinite memory range (Fig. 6.18).

There are typically two or more pointers:

Write pointer. This is the address of the physical storage cell that will be used for the next write action. After writing one record the pointer is incremented (and of course at the end of the physical memory range turned around to the beginning of the range). It is a matter of mission design if the write process is stopped when it reaches or overpasses the delete or read pointer. A monitoring of the distance between the pointers may be necessary for the ground control team. Possible measures against this situation would be to throttle down the write data rate or to arrange for additional downlink time.
Read Pointer. This is the address of the physical storage cell the next data will be read from. After the reading action the pointer will be incremented (or turned around as above). A potential overpassing of the write pointer is not a problem, but leads to a duplication of already downloaded data which has to be handled in the ground system. The read pointer may be pushed by the write pointer. The reading process may be triggered from ground or it can be an automatic continuous process. There may be several read pointers that can be used by different users.
Delete Pointer (optional). This can be a pointer that lags behind the read pointer and indicates ranges that the ground control center has successfully retrieved and approved to be deleted. The delete pointer may be a barrier for the write process. In other implementations this function can be taken by the read pointer. However, if a mission cannot risk to lose data a ring buffer concept may not be the ideal solution.

The application process and the operators on ground (or the mission planning process) need only very little knowledge about the storage. The difference between read, delete, and write pointer define filling grades. Also it will usually be possible to modify the read pointer e.g. to repeat an unsuccessful dump action.

6.2.4.5.2 File System

A file storage system replicates data structures that are similar to the known data files systems in PC computers. These files are linear data storage areas that are of a certain common nature. Files can be created, named, filled, closed, read, copied, modified, concatenated, and deleted on board. They can be uploaded from ground and downloaded (dumped) to ground. They have a unique handler or name and they may have common attributes like file create date, last modified date, and access rights or other meta data attached to it. A very appropriate use for this is the handling of on-board software patches or instrument measurement items (images, data takes) that are of a piecewise nature. It is also possible to fill files with continuous datastreams like housekeeping telemetry, but this is currently quite uncommon and has no special advantage over a linear buffer or a ring buffer. The necessary operational tasks can be all of the abovementioned file methods. Partially they may be taken over by automatisms.

6.2.4.5.3 Linear Storage

Linear storage is the third method for large storage devices, especially if they are used for housekeeping telemetry or continuous measurements. It is preferred over the ring buffer if the stored data must not accidentally be overwritten. Usually also here pointers for reading and writing are used but also random access methods can be employed. If the reading, writing, and deletion management is fully automated on board, then no difference to a ring buffer exists. Therefore the strength of the linear buffer lies in the random access and the protection of written data which implies a manual data management. Also per definition a linear store will be full at a certain point in time and a new store has to be used until the old store has been completely read and can be emptied. The operational tasks will be to direct the data stream to a selected store, to monitor the filling level, to control the reading process (possibly repeating unsuccessful dumps), and to reset the pointers to zero when a store is full and has been read completely.

Advanced mass memory concepts can define several instances or combinations of these storage methods. These storage areas (sometimes called “stores”) may be filled with data from different sources or it can be sampled at different intervals or be targeted at different ground destinations.

The management of the data that is written to the storage usually involves the mission planning and the data-handling expert. They have to define what to store and at what rate. This has to be checked against the available memory and the time to the next downlink occasion. The process to download the stored data (payload or housekeeping) is called dumping. Higher data rates may be used. In order to save downlink bandwidth and mass memory it is possible to use data compression techniques (Evans and Moschini 2013).

Memory maintenance is usually not necessary for solid-state memory. Typically it will be equipped with EDAC mechanisms. Tape recorders’ reels had to be rewound regularly to avoid tape-sticking and data sections had to be regularly reformatted and rewritten (in different arrangement) to avoid magnetic fading and copying effects.

6.2.5 Summary and Outlook

The OBDH and its operation have changed fundamentally in the last decades as the on-board storage and processing capabilities have increased dramatically. This chapter presented the fundamental activities that are connected with the operations of the Data-Handling Subsystem.

A few trends are obvious to increase in the near future. From the end users there will be an even higher demand for data storage and for data protection. The mission complexity and the shorter development cycles will demand more on-board flexibility and autonomy. This will result in more powerful computer hardware and advanced software on board and therefore, like on ground, a higher demand for software maintenance and adaptation during flight.

Standardization of data access and maintenance methods as described in the Packet Utilization Standard (ECSS 70-41A 2003) is used to streamline the systems and methods. This process is still ongoing, but already it has shown positive harmonization effects that in the end all parties involved will take profit from.

6.3 Power and Thermal Operations

Sebastian Löw,
Kay Müller &
Sina Scholz

German Aerospace Center (DLR), German Space Operations Center (GSOC), Oberpfaffenhofen, 82234, Wessling, Germany
Sebastian Löw, Kay Müller & Sina Scholz

6.3.1 PTS Design Aspects

6.3.1.1 Power System

All electrical systems require electrical power in order to function. For most stationary electrical applications on Earth this power is generated by an electric generator which basically consists of a conductor rotating in a magnetic field, using the physical effect of electromagnetic induction. The means to move the conductor are to a high percentage obtained by converting heat into mechanical energy with the heat originating i.e. from chemical energy contained in combustible substances such as coal or oil or gas. Another possibility is to use mass defects of atomic nuclei. For convenience, many appliances are spatially separated from their power supply. Energy is provided by a power plant located kilometers away using one of the abovementioned means to generate energy which is then transported to its various consumers via the electrical grid.

Whenever mobility is involved, the means to provide power need to become smaller and lighter in order to be able to be taken along. Also the separation of power source and consumer is no longer present. Like many power plants, cars or aircraft convert chemical energy contained in fuel into thermal and then mechanical energy via combustion. Their engines are significantly scaled down versions of the large power plants. For even smaller devices such as cell phones and laptops, batteries become the power supply of choice since they can store a limited amount of energy.

For space missions the concept of mobility becomes especially severe. Spacecraft cannot be refueled like airplanes or cars or recharged by plugging them in like cell phones. Therefore, all the elements necessary to provide electrical power have to be put on board and designed to be sufficient throughout the desired mission time. All approaches to spacecraft power systems are variations of this theme with the following commonalities:

Electrical power usually needs to be generated on board (Primary Energy).
It needs to be conditioned, which means to be converted and regulated, to suit the needs of the various units, specifically operating voltages and currents. Some units might require a constant voltage for example. This usually leads to separate power buses,^{Footnote 1} regulated and unregulated, which connect their respective units (Power Management and Distribution).
The spacecraft might need more power than the primary power source can provide and must also be able to function when no primary power is available at all. Therefore, the possibility to store energy must be implemented. This is normally done by using batteries which makes some sort of charge control necessary. Stored energy can then be fed back into the system at a later point (Storage).

A schematic drawing of a spacecraft’s power system can be seen in Fig. 6.19.

6.3.1.1.1 Energy Sources and Storage

The basis of each energy supply is a physical effect which is exploited technologically. Examples are numerous; see Table 6.4.

Table 6.4 Physical phenomena used for the generation of electrical power in spacecraft

Full size table

6.3.1.1.2 Solar Panels

One widely utilized option for power generation is the photovoltaic effect. The principle of photovoltaics, literally “voltage through light,” makes use of the fact that electrons in semiconductors can be excited by photons—such as solar irradiation—to a higher energy level but cannot “go back” due to a built-in junction in the semiconducting material. As such a solar cell is a charge separator. The electrons can then move through an external circuit driven by the electrical potential created by the separation of the charges. The potential and thus the voltage are dictated by the semiconductor materials that are used.

For initial estimates for satellites orbiting the Earth, a solar irradiation of S _Earth = 1,367 W/m² can be assumed. Given a desired electrical power P _Earth to be generated and an efficiency μ one can approximate the required solar array area to be

$$ A=\frac{P_{\mathrm{Earth}}}{\mu {S}_{\mathrm{Earth}}}. $$

(6.1)

The solar power per square meter at other distances r from the sun can be computed by including the square of the distance ratio:

$$ A=\frac{P}{\mu {S}_{\mathrm{Earth}}{\left(\frac{r_{\mathrm{Earth}}}{r}\right)}^2}. $$

(6.2)

Thus, at twice the distance from the sun only a quarter of the power is available per square meter and the area of the solar panel has to be increased accordingly to reach the same electrical power.

In order to generate a desired voltage a solar panel consists of multiple solar cells which are electrically connected in series—whereas the voltages of the individual cells add up. One such series of solar cells is referred to as a “string.” To reach a certain desired current output multiple strings are connected in parallel. In order to avoid damage of the solar cells by a reversed current (which occurs when a battery is discharged), each string is usually decoupled from the bus using a diode. Modern solar cells have efficiencies of more than 30 %. Since there is no filtering of sunlight in space they can generate more power than similar cells on the ground. The panel temperature has a rather large influence on efficiency. Low temperatures yield more power output. This is the case because at lower temperatures the band gap is larger which means electrons that have been excited by incoming photons have received relatively more energy which in turn results in a higher voltage. The loss of power at the maximum power point is about 0.5 %/K. High temperatures of up to about 130 °C cannot be avoided though, as the solar panel is naturally exposed to solar irradiation. With increasing age, degradation will also become an issue.^{Footnote 2} A loss of efficiency of 0.5 % per year can be assumed for crystalline cells even though the real value will usually be below that. For thin film solar cells the degradation is much more rapid in the first 1,000 h, up to 25 %. Almost no degradation occurs after that, though (Deng and Schiff 2002).

6.3.1.1.3 Electrochemical Cells: Batteries

Similarly to a solar cell, an electrochemical cell generates a voltage by separating charges. The process by which that separation occurs is in this case a chemical reaction.^{Footnote 3} The energy needed for that charge separation is contained in chemical energy. There are electrochemical cells in which the chemical reaction can only work in one direction. The original state can thus not be restored and the cells can only be used once. These are called primary batteries. A type of battery whose chemical reaction can work in both ways is called a secondary battery. In these, the reversal of the current restores the chemical substances to their previous state (charging) so that the charge separation can start anew (discharging). The familiar term battery refers to the combination of several electrochemical cells.^{Footnote 4} Like solar cells, electrochemical cells are connected in series (a string) to generate a higher voltage than each cell individually could provide. These strings are then connected in parallel in order to reach a desired current. A main figure of merit for batteries is the amount of ampere hours they can hold.^{Footnote 5} Almost always, electrical energy generated by solar cells is being used to charge the batteries so that the energy that is stored in the battery can be used at a later point when no sun is available or more power is needed. A surplus of solar-electrical energy is usually designed into the power system so that the solar arrays can both supply power for the spacecraft loads as well as power for charging the battery at the same time. The battery then also needs to be designed such that it alone can supply the spacecraft loads when no solar irradiation is available. Peak loads that can be much higher than the usual ones need to be taken into account as well.

In principle, however, the charging/discharging process cannot go on indefinitely. Since the battery hardware itself, specifically the electrodes, take part in the chemical reaction the electrode material degrades with time. Degradation can occur both chemically as well mechanically. For instance, the electrode material dissolves in the electrolyte and the electrode material becomes damaged due to the constant in- and out flux of ions. Degradation occurs in all types of batteries. To some extent, measures can be taken to limit these effects. Accurate temperature control for instance can help limit side reactions that produce no electricity and only degrade the electrodes. Performance can also be improved by making sure all the cells perform similarly (cell balancing). If some cells perform worse than others their charge/discharge cycle is shifted to lower charge levels which means these cells are already fully charged during the charge process when the others are not. Since the rest of the cells are not full yet the charging process continues while the “bad” cells are being overcharged which in turn become warm and affect the battery as a whole.

An older type of battery that is still in use is the NiH₂ battery.^{Footnote 6} It is well known for being long lived as well as rather robust over a relatively large temperature range. However, it suffers from a lower energy density (J/kg) and self-discharging while the energy efficiency is 85 %.^{Footnote 7} A more modern battery that does not have those downsides is the Lithium-Ion battery. Such a battery is comparably lightweight, has a high energy density, and experiences virtually no self-discharge. However, it is sensitive to high temperatures and high depths of discharge. Its efficiency is between 80 and 90 %.

6.3.1.1.4 Electrochemical Cells: Fuel Cells

In a conventional battery the chemical reaction takes place between the electrolyte and the electrode material. Another type of electrochemical cell is the so-called fuel cell. It can be distinguished from batteries in that the chemically reacting substances are not part of the battery structure such as the electrodes but are added from the outside like fuel, hence the name. Fuel cells therefore do not suffer from degradation but they have the disadvantage that the reacting substances have to be stored in additional tanks. Almost exclusively, hydrogen and oxygen are used with hydrogen as the fuel^{Footnote 8} and oxygen as the oxidizer. In this case the efficiency is up 60 %.

6.3.1.1.5 Radioisotope Thermoelectric Generators

While solar arrays in combination with batteries make sense when a spacecraft is relatively close to the sun, the required area for generating the same amount of power increases with the square of the distance to the sun, as indicated by Eq. (6.2). Therefore, most spacecraft for explorations beyond the orbit of Mars^{Footnote 9} use a different power supply called a radioisotope thermoelectric generator (RTG). The device contains radioisotopes, usually Pu-238 due to its long half-life of 87.7 years. The decay of the plutonium heats up the surrounding casing and thus causes a temperature gradient which according to the Seebeck effect generates an electric voltage. This system has several advantages as it can provide power for decades, has no moving parts, and is therefore autonomous and maintenance free. Its greatest disadvantage is the low availability of Plutonium and the associated high prices. Also, the thermal efficiency of an RTG is at best 8 % rather low.^{Footnote 10} Due to large area contamination threats in case of a launch failure RTGs are often criticized by the public. These are designed so that they can withstand such an event, though. Famous examples of spacecraft to use RTGs are Cassini, Voyager, as well as the Mars Science Laboratory Curiosity rover.

6.3.1.1.6 Nuclear Fission (and Fusion)

The most powerful energy source in practical use on Earth today is the process of nuclear fission. Only a few tests in the direction of nuclear powered spacecraft were made, although a nuclear reactor as a primary power source would represent an enormous step forward for many types of space missions: The amount of power generated on board determines among other things what kinds of and how many payloads can be taken along. A reactor in combination with an electric propulsion system could potentially also provide an advantage when it comes to improving travel times within the solar system.

Using nuclear fission or fusion, energy is gained by making use of a physical effect that directly converts mass into energy. The mass of an atomic nucleus is slightly lower than that of the sum of its nucleons (protons and neutrons). Therefore, average of the mass per nucleon is also lower. This is called the “mass defect.” It depends on the number of nucleons, i.e., the element and isotope. As can be seen in Fig. 6.20 the mass per nucleon first decreases with the number of nucleons in the atom and then increases again.

It is possible to use these differences in average nucleon mass of different elements and isotopes technologically for the generation of energy. If the nuclear reaction happens in the direction from heavier to lighter nucleons the difference in mass is released as the equivalent energy E = Δmc ². Splitting heavier elements into lighter ones is called fission and combining lighter elements to form heavier ones fusion. Fusion can theoretically provide about a factor of ten more energy than fission. This is due to the fact that the mass defect increases much more rapidly for lighter elements, as seen at the very left of Fig. 6.20.

“Mass Defect” and “binding energy” are to be understood as synonymous since the binding energy is the energy equivalent of the mass defect. The binding energy is not part of the “energy content” of nucleus. It is the energy that would have to be added in order to separate the constituent particles of that nucleus. The added energy is then used to make up for the difference between the lower mass of the nucleons in the nucleus and the higher actual mass of the protons and neutrons in their separate state. The same holds true when different elements are compared. If Helium-3 were to be generated out of Helium-4 (fission) the difference in mass (or mass defect) would have to be added as equivalent energy. Similarly, as stated above, that same amount of energy is released in the opposite fusion reaction.

Ultimately responsible for the shape of the curve seen above is a combination of the strong interaction and the electromagnetic interaction. The strong interaction is what holds the constituent elementary particles of protons and neutrons together due to the different “color.” A residual strong force is what holds together the nucleons in an atomic nucleus. Due to this attracting force there is a potential trough—energy would have to be added to separate the particles or, the other way around, energy is released as the particles enter this bound state. This released energy is the “binding energy” and the cause of the mass defect as described above.

The residual force is strong enough to overcome the electromagnetic repulsion of protons but has a relatively short range. That short range is the reason why atomic nuclei are not of arbitrary size. The electromagnetic force becomes relatively stronger with increasing atom size, preventing the nuclei from entering a more bound state. Therefore, the mass defect also decreases, starting at Fe-56.

6.3.1.1.7 Power Regulation, Conversion, and Distribution

Batteries can be charged if the power generated by the solar panels exceeds the needs of the spacecraft’s systems. On the other hand, that power is not needed all the time and can in fact be harmful. Once the battery is fully charged additional power from the solar panel would actually damage it. Thus, a method to limit the charging of the battery and thus control the power generated by the solar panels must be employed. Often, a maximum power point tracker is used. This is essentially a controller with the dual purpose of firstly keeping the operational point at the maximum power point, as explained in Fig. 6.21, when the battery needs to be charged and secondly terminating the charge process of the battery by shifting the operational point towards the open circuit voltage when the battery is fully charged. This is done by increasing the resistance of the charge regulator and thus the combined regulator and bus load.

The solar array always operates where the generated power is sufficient to cover the then present bus load. When the bus load increases to values the solar array alone cannot provide the battery is used as well and its voltage decreases. This causes the maximum power point tracker to shift the voltage of the solar array towards that of the maximum power point in order to provide as much power as possible. This goes hand in hand with the usage of the battery. As soon as the maximum power point is reached the battery provides the rest of the needed power while the solar panel remains at its maximum power point. The battery is discharged. When the bus load decreases again power generated by the solar array is available and is used for charging the battery. Once the battery is fully charged the charge current is decreased by gradually shifting the operational point of the solar array closer to the open circuit voltage, thus generating less power and preventing overcharging the battery.

Another cheaper but less sophisticated method is to use shunts for every string of the solar array which can then be decoupled from the main bus individually. The unused power will then be turned into heat at shunt resistors which are usually located in the Power Control and Distribution Unit (PCDU).

Power needs not only be provided per se but provided at specific places in specific forms and at specific times. Spacecraft loads are usually the various on-board units such as electronics boxes, instruments, or reaction wheels. Many of these units might require a specific constant voltage to operate, therefore making a voltage conversion necessary. Consequently, most satellites have both an unregulated and a regulated voltage bus. The unregulated voltage bus usually consists of the connections between the battery and solar panels as well as the charge controller and other associated hardware. The unregulated voltage will therefore be whatever voltage is present at the battery and can vary significantly over time. For units that require a constant voltage, converters are necessary that convert the voltage to a specific and constant one. A voltage that is often used is 28 V, but lower ones are also in use such as 5 V for on-board computers for instance. Usually, the functionality of controlling and distributing power described above is combined in a box mostly called PCDU. The PCDU also provides means to protect against overcurrents. The input to that box is the unregulated power from the battery and solar panels. The output is both unregulated and regulated/converted power. The power is then routed to the units that require it. The PCDU is usually controlled by the OBC via an interface. In Fig. 6.22 schematics of the PCDU of the TerraSAR-X and TanDEM-X spacecraft can be seen. The spacecraft loads are comprised of the bus components such as star cameras, reaction wheels, computers, and payloads.

All the various spacecraft functions are physically located in individually placed boxes. This allows for easier design as each box can be created on its own and only the interfaces have to be determined beforehand. What such design philosophy can look like can be seen in Fig. 6.23.

6.3.1.2 Thermal System

Another major topic in spacecraft design are the temperatures the spacecraft and its components have to function in. For many internal units these temperatures are desired to be at about “room temperature.” Other units that are exposed directly to the space environment such as solar panels have to be able to withstand a wider temperature range, e.g., from −90 °C to +130 °C. Most attention needs to be drawn to the units with a very narrow operating temperature range. As can be seen in Fig. 6.24 the battery and the propulsion system are often drivers for the thermal design.

The overall temperature balance of a body is determined by the heat that it produces itself and the heat it receives from the outside versus the heat that is transported away from it (see Fig. 6.25). Since internal heat sources have to be taken into account the thermal system is closely intertwined with the electrical power system. The operation of units changes the temperature conditions and the temperature conditions determine the operability of units.

The additional heat generated on board must also be carried away. It becomes therefore evident that the transfer of heat plays a fundamental role in spacecraft design.

Very generally, there are three mechanisms of heat transfer: conduction, convection, and radiation. A temperature difference is always the driver with other parameters determining the effectiveness.

Conduction is the process of heat being transferred from one atom to the next within solid bodies but also within fluids and gases. This principle can be seen in Fig. 6.26a. In physical terms, the material-dependent property of how well heat is conducted is called thermal conductivity. It is evident that the thermal conductivity is much higher in solid bodies since there the average distance between atoms is much smaller than it is in gases, for instance. But of course, this property also varies widely between different solids.

Convection (see Fig. 6.26b) is another effective heat transfer mechanism that specifically makes use of the non-solidness of gases and fluids: they can move and thus carry away heat. There is free convection—where density differences caused by temperature differences result in movement in the presence of gravity and thus the transport of heat—and forced convection where the fluid moves due to an external cause, e.g., a pump or a fan.

The third mechanism is heat radiation (see Fig. 6.26c) where the heat transfer occurs by electromagnetic waves in the infrared range of the spectrum. Every physical body radiates heat. The radiated power of a body that exchanges heat with its environment exclusively via radiation is determined by the fourth power of its temperature T, its emissivity ε, its radiating area A, as well as the Boltzmann Constant σ.

$$ P=\varepsilon \sigma A{T}^4. $$

(6.3)

When these three principles of heat transfer are applied to spacecraft design it becomes clear that convection cannot be used the same way it is on Earth where it is a prominent natural and technical mechanism for temperature regulation. A technical example is a car which partially uses air from the environment to cool the engine. In free space, there is no external medium present that could allow for convection to happen. Free convection cannot occur at all due to the “lack of gravity” which could induce air movement. Within a spacecraft only forced convection is possible. In the pressurized modules of the International Space Station (and even some satellites), for instance, the air has to be constantly kept in motion artificially by a ventilation system.

The absence of convection and the absence of matter around the spacecraft leave radiation as the only means to transport heat away from the spacecraft. With only one effective cooling mechanism it is clear that for most missions—despite the common knowledge of space being “cold”—the concern is not so much that a spacecraft becomes too cold but rather that is becomes too hot due to the lack of effective heat rejection capability.

Of course, the prevention of heat loss can be a concern as well. But it is obviously easier to heat up a unit by switching on an electrical heater than it is to cool something by “switching on heat transfer.”

Therefore, for first estimations, the assumption is made that a spacecraft needs to be able to emit all the power it generates.^{Footnote 11} That means cooling needs to be “built in” at the very beginning of the design phase while heating could in theory be treated as an afterthought—provided enough electrical power is available.

Also, variations in the power consumption of a unit and the resulting changes in the heat balance are usually handled by adjusting the heating rather than the cooling function of the spacecraft. It is, however, possible to build spacecraft where the thermal regulation works completely passively and autonomously. This can be done for spacecraft which do not experience large variations in their power generation and consumption. Then the radiated power can be set accurately enough for all the units to remain within their operational temperature range without the need for additional heating.

Regulating the temperature is at first dealt with by insulating the spacecraft using multilayer insulation (MLI) foil. This serves two purposes: It prevents radiative heat loss into space and due to its reflective golden layer also excessive heat-up from the sun or the Earth’s infrared radiation. In order to allow for heat to escape special radiative surfaces are employed. These should be placed strategically so that they face deep space and thus minimize heat absorption from external sources which would decrease the radiator’s effectiveness. As can be seen in the equation for the radiated power [see Eq. (6.3)], the ability of a surface to emit heat is directly proportional to its emissivity. Consequently, radiating surfaces are usually treated with paint or coatings which have a high emissivity, for instance with white paint.

The emitted energy also is directly proportional to the fourth power of the temperature. Therefore, a higher radiator temperature would significantly increase its thermal energy rejection capability and thus allow a smaller area and consequently a lower spacecraft mass. However, in a passively cooled system the radiator needs to be cooler than the unit it is supposed to cool in order to maintain the heat flow from warm to cold. For passive heat transfer the radiator temperature is thus rather low, often below 0 °C. A high radiator temperature is in principle possible, but this comes at the cost of having to employ active heat transfer which can transport heat from a warm unit to an even warmer radiator. Such a system functions similarly to a common refrigerator where heat is transported from the inside of the refrigerator to the warmer outside. Energy needs to be added to allow for the “heat pump” to work. Due to the complexity of such a system and the added mass of the active components it is usually not employed on satellites unless absolutely needed. Examples are often scientific spacecraft that have infrared telescopes as payloads which need to be cooled to very low temperatures.

Heat transport (and prevention thereof) within the spacecraft itself is primarily realized via the usage of materials with either low or high thermal conductivity. High conductivity is used wherever heat transport is explicitly desired. This is often the case when heat shall be transported from a unit to a radiator. Low conductivity is used for parts of the spacecraft that shall be thermally insulated. Solar panels are an example since they are by definition oriented towards the sun and thus rather warm. Thermally insulating them shall prevent too much heat from entering the spacecraft itself via the panel structure or attachment joints.

Another common heat transfer component is the heat pipe. A heat pipe is in principle a closed pipe that contains a working fluid which evaporates at the high temperature end; the gas fills the pipe and then condenses back into liquid form at the cool end. A wicking material causes the fluid to move back to the hot end where it can evaporate again. Heat pipes are common thermal connectors to radiators.

Thermal Control predominantly makes use of electrical foil heaters. These are in principle wires encapsulated in Kapton foil that are being heated up by resistance heating. The other part of thermal control is the need to measure temperature. Such a temperature measurement is mostly done by thermistors which are electrical resistors where the dependence of the resistance R on the temperature is well known, e.g.,

$$ \frac{R}{1\;\Omega}=1,000\left(1+3.9083\times {10}^{-3}\left(\frac{T}{1{}^{\circ}\mathrm{C}}\right)-5.775\times {10}^{-7}{\left(\frac{T}{1{}^{\circ}\mathrm{C}}\right)}^2\right) $$

(6.4)

for a common type of thermistor called PT 1,000^{Footnote 12} (T is here the temperature in °C without unit).

Whether or not a heater needs to be switched is determined by the OBC which checks the temperature readings of the thermistors at certain intervals. These readings are then compared to on and off thresholds which can be changed from the ground. When the temperature is below the on-temperature the heater is being switched on and when it is above the off-temperature it is switched off again. Any temperature measurement (or any measurement in general) is originally analog and must be converted into a digital signal in order for the computer to be able to use it. This conversion usually leads to an uncertainty in the measurement. The bit range to represent a certain temperature range then determines the accuracy of the measurement. For instance, a 12-bit string can describe 4,095 values, which allows for a temperature range from −160 °C to +160 °C to be accurately measured to within 0.078 °C which is sufficient for temperatures. Thus, in reverse logic, the desired accuracy of the measurement determines the bit range in the design phase.

6.3.1.2.1 Operational Needs

The above is one example of a general principle: The design of a spacecraft must meet the operational needs. Therefore, thorough design and testing need to be employed to have accurate measurements and avoid interference among units and sensors. For instance, the magnetic field sensors on board a spacecraft whose purpose is to measure the Earth’s magnetic field for attitude determination must not be perturbed by other magnetic fields generated on board. For this reason magnetic fields like those generated by high currents need to be avoided by using twisted wires with opposing currents which cancel each other’s magnetic fields. Unavoidable disturbances must be known beforehand and included in the on-board software, preferably in the form of commandable settings so that they can be adjusted later in the mission. Another example are batteries that might need to be operated within tight limits—especially towards the end of missions. Here, accurate measurements of state of charge, voltage, currents, and temperature are absolutely critical to ensure proper handling from the ground. It must therefore be known by the spacecraft designer what to include in the telemetry and how and where that telemetry is measured in order to allow for safe and reliable operations.

6.3.2 Operations

6.3.2.1 Preparation Phase

Satellite power and thermal system operations start several years before a spacecraft is launched. As soon as the satellite design is determined one has to consider the consequences and necessary actions for operations. Depending on the satellite design (see previous chapter) and the mission requirements on the power and thermal system, an operations concept has to be developed.

A so-called power thermal model is generated for most satellite missions. This model e.g. allows estimations how long operations, maneuvers, or data takes can last without discharging (and/or heating up) the battery too much. The thermal model part contains on the one hand all critical temperatures (e.g., instrument temperatures during operation) and on the other hand the thermal behavior during warm-up and cool-down. Depending on actual heat dissipation, heat capacity, and operation phase, the warm-up of the units is largely linear with time whereas the cool-down in general shows an exponential temperature drop. This is caused by the reason that during heating up the conducted power (generated by a heater) is constant whereas during cool down the dissipation of heat depends on the temperature of the thermal environment within the satellite. The battery charge control model is driven by the total power over time. It includes much information about the charge behavior of the battery, the number of allowed charge cycles, and the maximum Depth of Discharge (DoD).^{Footnote 13}

6.3.2.2 LEOP Operations

After the launch it is necessary to bring the satellite into a nominal operating state as soon as possible in order to lower the risk of power problems. For many space missions, power is generated by the combination of solar panels and batteries (see Sect 6.3.1). Several units such as the OBC, sensors, or heaters are switched on shortly after separation. The power therefore is drained from the battery as long as the solar arrays do not yet generate power.

For this reason one of the first actions after separation is the deployment of the solar panels (if they are designed to be deployable; see Fig. 6.27). Right before that, the power and thermal subsystem engineer needs to evaluate the situation. Since solar panels are deployed by activating pyro cutter mechanisms which require a certain operating temperature, this and other preconditions need to be checked. After deployment is finished, the operations engineer has to confirm that the solar arrays are fully deployed and working properly. During sun illumination they have to generate enough power to operate all of the satellite equipment and to recharge the battery for eclipses or times with higher power consumption.

After this is done and the spacecraft generates enough power for operations, several units need to be activated. As soon as all activation preconditions are met, the nominal and redundant units are powered on by ground command to test their functionality. Also several on-board data configurations need to be checked and adapted: Since the real behavior of the vehicle in space cannot fully be predicted in the design phase, the trigger limits for autonomous on-board reactions have possibly to be adapted after launch.

Launch delays of a spacecraft by several months or even years have negative effects especially on the spacecraft battery. Even if the battery is not used before launch it degrades over the time and therefore the usable power budget decreases. The rate of degradation depends on the battery type. Li-Ion batteries, for example, degrade only slowly. Spacecraft batteries are already charged on ground regularly to compensate the self-discharge, which could harm or even destroy the battery cells by deep discharging. Nevertheless a launch delay of several months or more leads to a battery with a lower capacity as desired.

If the battery already degraded before launch it is desired to find possibilities to increase battery health after launch. This is called reconditioning. It depends on the battery and satellite design, whether it is possible to adapt the charge level in order to avoid temperatures or voltages which are outside design specifications or not.

The reconditioning after launch sometimes causes additional work for the power and thermal system team. Charging the battery slowly and creating a small overcharge prevents e.g. NiH₂ battery cells from degradation.

The task of the operations engineer is to derive a set of parameters which can be commanded to the satellite in order to optimize the battery charge process. Of course it can be necessary to adapt the parameters several times over the whole mission.

6.3.2.3 Routine Phase

Once the satellite is in an operational state the telemetry is continuously being monitored and the health status of the spacecraft equipment and the behavior is evaluated over large time spans. Trends are analyzed to achieve better predictions for the future subsystem behavior. For that it is indispensable to differentiate which effects are caused by e.g. seasonal variations or operations and which are induced by aging or degradation. An example for a suspicious behavior, which is actually explainable by normal effects, is given in Fig. 6.28.

In case telemetry readings or trends cannot be explained, it has to be clarified whether the observed behavior is critical and whether any action is required.

6.3.2.3.1 Battery Discharge Process

Probably the most sensitive and stressed unit within the power system is the battery. An example for its degradation is given in Fig. 6.29.

Depending on the orbit and operational concept a battery sometimes has to go through thousands of charge cycles during its lifetime. Some experiments and payloads even need more power than the solar arrays generate. During operations they drain power which is stored in the battery and the battery is recharged once the operations have finished. For some missions the solar arrays generate power all the time, but payload operations are only performed over a certain amount of time (e.g., TerraSAR-X). For this type of mission the payload is allowed to drain more power as generated by the panels as the battery can be charged during periods without payload operations. For missions where payload operations are performed all the time [e.g., Gravity Recovery And Climate Experiment (GRACE)] it is necessary that the solar arrays produce more power than is used by the spacecraft.

The battery capacity is in fact the limiting resource for many missions, even more limited than propellant mass or available cycles of operations for thrusters or BUS^{Footnote 14} units (see Sect. 6.3.1). Here, the important characteristic is the number of charge/discharge cycles at a given DoD. The cycle lifetime increases as the DoD decreases (Nelson 1999). If the desired lifetime for a spacecraft is 5 years in LEO with 25,000 expected charge cycles, for example, it has to be ensured that the DoD is always below 15 %, assuming a behavior as seen in Fig. 6.30. This usually also is part of the power thermal model. Discharge can be caused by several things such as data takes, maneuvers, or eclipses. If analyses show that the DoD is already close to its limit for usual payload operations, the power and thermal engineer has to take care that no additional power-consuming operations (e.g., data takes) are done during an eclipse or a maneuver.

6.3.2.3.2 Battery Charge Process

Also the charge process needs to be well defined. Charging the battery slowly is the preferred operations concept, but need to be balanced with other requirements, like having a fully charged battery available at a certain time.

A slower charging of the battery can be achieved by rotating the satellite’s solar arrays away from the sun as the charge current depends on the effective illuminated area of the solar cells. A rotation of 30° decreases that area and therefore the charge current by approximately 14 %.^{Footnote 15} The smaller the charge current, the lesser heat will be produced during overcharging the battery. This makes it possible to charge the battery to a higher level of capacity without accepting an additional degradation.

Another possibility to influence the charge process is the so-called shunting of the solar array strings, which is essentially a partial deactivation of solar cells leading to a reduced current. As soon as a predefined charge level is reached shunting would be activated by the on-board software. When the state of charge drops again below the set DoD level shunting would be switched off and the charge process starts again.

The charge process can also be adapted to a decreased capacity by lowering the maximum charge level if it is adjustable per design^{Footnote 16}: Degradation of the battery can cause the effect that it is no longer possible to charge it to its Begin-of-Life (BoL) capacity—setting the maximum charge level to 100 % BoL capacity would consequently lead to an overcharge which would be converted into heat. Therefore the temperature within the battery would increase and possibly damage it. To avoid this, the power and thermal operations engineer has to adapt the maximum charge level to a reasonable level.

All of the scenarios mentioned above decrease the charge current which leads to the generation of less heat. Therefore, battery health can be preserved or even increased.

6.3.2.3.3 Battery Temperature and Performance

As already mentioned above an important factor for battery performance is temperature. The hotter the battery, the faster chemical reactions will occur. The desired chemical reactions on which the battery depends are usually accompanied by unwanted chemical reactions which consume some of the active chemicals or impede their reactions. Even if the cell’s active chemicals remain unaffected over time, cells can fail because unwanted chemical or physical changes to the seals keeping the electrolyte in place. As a rule of thumb, for every 10 °C increase in temperature the reaction rate doubles. Thus, an hour at 35 °C for lead-acid batteries is equivalent in battery life to 2 h at 25 °C, as shown in Fig. 6.31. Heat is the enemy of the battery and as Arrhenius (Laidler 1987) shows, even small increases in temperature have a major influence on battery performance affecting both the desired and undesired chemical reactions.

Battery temperature has therefore to be monitored very carefully during the whole mission. It is necessary to reach a compromise between the temperature being low enough to afford a long life time and being warm enough to provide good performance. It is the duty of the power and thermal engineer in cooperation with battery experts to determine the time whenever it is necessary to regulate the battery charging and to perform the required actions.

6.3.2.3.4 Thermal Subsystem

Besides all the necessary operations concerning the power system there also exist a set of actions that have to be performed for the thermal system. Almost every unit of a satellite has specified limits between which it has to be operated. Among the temperature-sensitive units are star trackers, flow control valves for thrusters, and the propulsion system. Their temperatures have to be observed over the whole mission and specific actions have to be performed if necessary. If a unit impends to cool down below its operational limit it is necessary to switch on its heater if available. If the unit does not have heaters sometimes it is even necessary to create new operational concepts. This can, for example, be to rotate the satellite in a way that the units are pointed towards the Earth or the sun (if they are too cold) or to rotate them away (if they are too hot).

It is obvious that all those analyses and actions would be a huge amount of work if it all has to be done manually. To make operational life easier, automatic checks and corresponding actions can be implemented in the spacecraft. Several parameters such as battery voltage, temperatures, and power statuses are monitored by the on-board software. As soon as one of these parameters is out of limit for a certain amount of time, a specific action is performed automatically (e.g., switch on heater if temperature is too low).

The degradation of units has to be analyzed periodically by the operations team and the responsible experts. The observed behavior has to be compared with the modeled one and resulting actions have to be derived from this.

The two images in Fig. 6.32 show the degradation of solar panels and a satellite battery. The causes for the reduced performance (see Sect. 6.3.1) can be aging, radiation, or charge/discharge cycles. These effects have of course an impact on satellite operations. When solar arrays and battery degrade this means that all in all less power is available. This has to be taken into account for all activities, monitorings, and limits. Therefore some values and parameters (e.g., heater set points, battery limits, etc.) have to be adapted periodically during the mission and actions to recover the battery cells (described in Sect. 6.3.2.2) can be performed. Furthermore it has to be analyzed if payload operations have to be changed. This can result, for example, in decreased observation duration to avoid deep discharge and preserve the battery.

6.3.2.4 End of Life

Most of the satellite missions are extended beyond its originally planned lifetime. Once the degradation of the power equipment reaches a (mission) specific point, the satellite operations cannot be continued as before, especially during eclipse season when the satellite is mainly dependent on battery power. Also the solar panels degrade, what lengthens the battery recharge. With advancing age of batteries and solar panels, the daily operations become time-consuming and are ruled by avoiding low-power conditions.

The GRACE (Tapley et al. 2004) project shows very explicitly how end of life (EOL) operations use to be. During eclipse phases, which are experienced twice per year^{Footnote 17} no power can be generated by the solar panels and thus the energy needed is drained from the battery. The eclipse duration varies from some seconds at the beginning to more than half an hour in the middle of the eclipse phase. By now (11 years after launch) the battery capacity is below 10 % of its original value. As a consequence the batteries cannot provide enough power to all units during long eclipses.

There are some operational tricks to deal with already weakened batteries. If it is possible to adjust the end-of-charge voltage of the battery, this charge level can be raised at the end of an eclipse to allow an immediate maximum charging of the battery after leaving the Earth shadow. After a certain time in sun condition, the charge level has to be reduced again to avoid an overcharge of the battery. If the battery power is no more sufficient to maintain the nominal satellite operation during an eclipse, it can be helpful to heat up parts of the satellite such as the propellant tanks during sun condition. The heat dissipation can then be used afterwards to keep the single units of the satellite in its temperature limits. Additionally, heater power can be saved by reducing the heater set points to a minimum during eclipse. (For some units this cannot be done for the whole orbit duration because payload data quality is temperature dependent).

If none of these measures is successful, the only remaining option is to switch off single units or at worst the whole satellite. This implies a major impact on the mission and involves a lot of subsequent adjustments of units like the OBC. Potentially even software uploads are then necessary to restore the required configuration. This worst-case scenario should be avoided under all circumstances.

Full sun orbits with continuous power generation can also be a threat to weak battery cells because of missing discharge processes. This would then result in an irreversible cell collapse due to electrolyte bridging. Again it is the duty of the operations team to avoid these. For the already mentioned GRACE satellite it is unfortunately neither possible just to disable some of the solar array strings as described above nor can additional consumers be switched on. One possibility to force the battery’s discharge is to generate some kind of artificial eclipse. This can be reached by rotating the satellite in a way that the solar panels are not irradiated by the Sun for some minutes. First of all it has to be clarified how often such “eclipses” have to be generated and how long they should be. Therefore a close coordination with the satellite support team and especially with the battery experts is required in order to find the best solution. Also the AOCS engineers need to be involved: While the AOCS team calculates what kind of rotation should be made to save as much fuel as possible (at EOL most likely fuel budget is very low, too), it is very important to figure out if such a rotation poses a threat to the thermal system with respect to allowed unit temperatures. Usually it is required to point the solar panels towards the Sun whenever it is possible. Therefore the spacecraft is designed such that all units which should be operated at low temperatures (e.g., star cameras) are mounted on the opposite side of the vehicle. When rotating the spacecraft to a not nominal attitude it could be that some units get too hot, others which are usually pointed towards the sun could cool down. So a compromise between thermal and power-driven attitude requirements has to be found.

These actions have to be planned, prepared, and executed carefully by the operations team. Monitoring limits for temperatures or voltages during the time without payload operations have to be adapted because charge and temperature behavior change (e.g., the temperature decreases if less payloads are operated). The switching has to be timed exactly to avoid voltage or temperature variations that would violate their limits and as a consequence trigger any unwanted on board mechanisms.

At the end of the satellite’s lifetime operations get harder and it is necessary to know the system very well to extend the mission as far as possible because the components within the power system are the limiting ones for most missions.

6.3.3 Contingency Operations

The power and thermal subsystem occupies a central position for the operability of a spacecraft because all systems need power and thermal control. When a PTS contingency occurs, it is not unusual that the whole spacecraft is affected. In a Multiple-Failure Scenario, the PTS subsystem engineers have to identify and to recover electrical failures first. In the case with several electrical failures, they have to begin with the failure most upstream. An example would be the failure of an on-board instrument and simultaneously voltage fluctuations of the relating power bus. Stabilizing the power bus would be in this case the precondition for a successful recovery of the failed instrument. Thermal failures allow in most cases to be solved subsequently because of the thermal inertia of the systems. Some spacecraft have dedicated modes for a failure of a cooling circuit or for a reduced heater activity in case of a low-power situation.

In some anomaly cases it is not directly obvious what caused the problem. If for example the output power of the solar panel is reduced there are a few different failures which can lead to a reduced output power displayed in the telemetry. As illustrated in Fig. 6.33, damage of a part of the solar panel (#1), cable break (#2), switch-off (#3a), or damage (#3b) of power regulation equipment or damage of a sensor (#4) could be the possible reasons.

As diverse the possible causes are as diverse are the effects on the mission. The loss of output power of the solar panel could be real (#1, 2, 3a, 3b) or not (#4) and possible to recover (#3a) or not (#1, 2, 3b).

In 2004, after about 3.5 years of the GRACE mission, first a DSHL (Disconnection of Supplementary Heater Lines) and afterwards a DNEL (Disconnection of Non-Essential Loads) occurred on one of the two satellites. For this kind of spacecraft there exist four stages of DNEL. A DNEL is caused by an undervoltage situation in the battery. The deeper the voltage drops the higher is the stage of DNEL and the more actions are performed automatically on board. In this case the spacecraft was found in thermal survival mode during ground station contact. In this mode all unnecessary heaters are switched off and the heater set points are lowered to a point where as little power as possible is needed to keep the satellite and its hardware alive. After analyzing the data it could be seen that a battery cell was lost and the battery voltage dropped below a defined threshold for more than 30 s, which triggered the first stage of DNEL. In addition to the change of the heater configuration several other on-board reactions are triggered by a DNEL. As the spacecraft is commanded to a coarse pointing mode which leads to a higher gas consumption, several hardware units are switched off which are not necessary for the safety of the satellite. The transmitter is switched to low rate to save power during ground station contact and all commands on board, which were saved in the timeline, are deleted to avoid power-consuming activities.

As one can see, there is a huge amount of actions necessary to get the satellite back operational. First of all, the EOC level settings (described in Sect. 6.3.1) have to be changed in order to compensate for the low-power situation. After this event in 2004, the EOC level was raised to get the battery stabilized. Additionally the spacecraft was commanded back to thermal nominal mode to reestablish the desired heater configuration. As the satellite transmitter was switched to low rate by an on-board action, a blind acquisition had to be made. This is because the spacecraft was configured to low rate while the ground station was configured to high rate. The reconfiguration on board was in this case faster than one on the ground. This means that the subsystem engineer had to prepare a procedure to switch the transmitter back to high rate to see telemetry. As the complete timeline on board the spacecraft was empty, he also had to ensure that the transmitter will be switched off again at the end of the ground station contact to save power. The timeline had to be updated and reloaded. The payload equipment had to be switched on and set up again as soon as enough power was available. The telemetry had to be analyzed to find out which autonomous on-board actions were executed because an on-board action is disabled directly after triggering to avoid a continuous execution. All executed actions had to be re-enabled after the recovery to ensure satellite safety in case of a similar problem in the future. For example, the voltage drop could occur every eclipse because the battery does not gain enough power. If one does not re-enable all necessary on-board reaction after setting the heater configuration or switching on some units, no on-board actions will be triggered during the next low voltage situation. This could lead to a voltage drop below a limit acceptable for the OBC unit. In the case of the GRACE mission the switch-off of the OBC would be equal to the loss of the mission because neither an autonomous reboot of the OBC unit is foreseen nor the execution of any on-board telecommands.

6.4 Propulsion Subsystem Operations

Franck Chatel

German Aerospace Center (DLR), German Space Operations Center (GSOC), Oberpfaffenhofen, 82234, Wessling, Germany
Franck Chatel

6.4.1 Principle of Propulsion

Satellite or rocket propulsion systems are based on the action–reaction principle: thrust arises in reaction to the expulsion of mass. The same principle is at work when a cannon is fired and moves backwards after the shot.

Some simple physics allows quantifying the force created by the expulsion of mass. Consider a satellite of mass m moving through space with a velocity vector V, as shown on Fig. 6.34. The propellant mass dm to be expelled is bound to the satellite and moves with the same velocity vector. An instant dt later, the mass is expelled with an exhaust velocity V _e relatively to the satellite body, which receives a velocity increment dV. Newton’s second law of motion relates the change in impulse of the considered system to the sum of the external forces F acting on this system.

In the present case, the system composed of the satellite is open since its mass varies due to the expulsion of propellant mass. Newton’s second law, however, applies to closed systems so that one has to consider the system composed by both the satellite and the expelled propellant mass. Before the expulsion of the propellant mass, the impulse of the system is p ₁ = (m + dm)V whereas after the expulsion, it becomes p ₂ = m(V + dV) + dm(V + V _e). Newton’s second law then yields:

$$ \boldsymbol{F}=\frac{\mathrm{d}\boldsymbol{p}}{\mathrm{d} t}=\frac{{\boldsymbol{p}}_2-{\boldsymbol{p}}_1}{\mathrm{d} t}= m\frac{\mathrm{d}\boldsymbol{V}}{\mathrm{d} t}+\frac{\mathrm{d} m}{\mathrm{d} t}{\boldsymbol{V}}_{\mathrm{e}}. $$

The change in impulse is different from the usual product of the mass by the acceleration vector: an additional term appears because of the mass variation. This relation can be reordered as follows:

$$ m\frac{\mathrm{d}\boldsymbol{V}}{\mathrm{d} t}=\boldsymbol{F}+\boldsymbol{T} $$

with

$$ \boldsymbol{T}=-\frac{\mathrm{d} m}{\mathrm{d} t}{\boldsymbol{V}}_{\mathrm{e}}. $$

(6.5)

This reordering shows that the situation can be seen as equivalent to a usual closed system (term on the left-hand side), except that a new force T, the thrust, must be introduced. Of course, one must keep in mind that the satellite mass m is variable. However, it can often be considered as quasi-constant when the expelled mass is small with respect to the satellite mass.

The expression obtained previously shows different features of the thrust:

Its direction is opposed to the one of the exhaust velocity, which reflects that this force is a reaction
It is proportional to the exhaust mass flow rate dm/dt
It is proportional to the exhaust velocity

The norm of the exhaust velocity vector is often written as the product of the standard gravity g ₀ ^{Footnote 18} by the specific impulse (noted I _sp and expressed in seconds). One can then write

$$ {\boldsymbol{V}}_{\mathrm{e}}={g}_0{I}_{\mathrm{sp}}{u}_{\mathrm{e}} $$

(6.6)

where u _e is a unitary vector aligned with the direction of the exhaust velocity. Consequently, the expression of the thrust becomes:

$$ \boldsymbol{T}=-\left({g}_0{I}_{\mathrm{sp}}\frac{\mathrm{d} m}{\mathrm{d} t}\right){\boldsymbol{u}}_{\mathrm{e}}. $$

(6.7)

From this expression, one can say that the higher the specific impulse, the less the mass flow rate required to produce the same thrust level. This expression is quite general and applies to all kind of engines, even if part of the propellant is not stored on board as it is the case for airplanes.

Specific impulse is used to distinguish classes between different propulsion systems. Chemical systems use a chemical reaction to produce gases, which are subsequently expelled through a nozzle. For such systems, the mass flow rate is rather high because the expelled gases are quite heavy. However, the exhaust velocity is rather low, leading to specific impulses on the order of 250–500 s. On the other hand, an electric system can use high-power currents to produce ions that are then accelerated by a magnetic field before being expelled. In this case, the mass flow rate is rather low, but the exhaust velocity is very high, leading to specific impulses in the order of 1,500–3,000 s.

Finally the equation of motion can be integrated under some assumptions into the so-called ideal rocket equation.^{Footnote 19} If one assumes that all external forces are negligible with respect to the thrust and that the exhaust velocity vector is constant over the maneuver duration then one can write:

$$ m\frac{\mathrm{d}\boldsymbol{V}}{\mathrm{d} t}=-\frac{\mathrm{d} m}{\mathrm{d} t}{\boldsymbol{V}}_{\mathrm{e}}=-\left({g}_0{I}_{\mathrm{sp}}\frac{\mathrm{d} m}{\mathrm{d} t}\right){\boldsymbol{u}}_{\mathrm{e}}. $$

(6.8)

Denoting the initial and final conditions with subscripts “i” and “f” respectively, one gets

$$ {\displaystyle {\int}_{V_{\mathrm{i}}}^{V_{\mathrm{f}}}\mathrm{d} V=\left({g}_0{I}_{\mathrm{sp}}{\displaystyle {\int}_{m_{\mathrm{i}}}^{m_{\mathrm{f}}}\frac{\mathrm{d} m}{m}}\right){\boldsymbol{u}}_{\mathrm{e}}}. $$

The terms are rearranged to give the usual form of the ideal rocket equation:

$$ {\boldsymbol{V}}_{\mathrm{f}}-{\boldsymbol{V}}_{\mathrm{i}}=\Delta V{\boldsymbol{u}}_{\mathrm{e}} $$

with

$$ \Delta V={g}_0{I}_{\mathrm{sp}} \ln \left(\frac{m_{\mathrm{i}}}{m_{\mathrm{f}}}\right). $$

(6.9)

6.4.2 Configurations of Propulsion System

Having understood the physics behind propulsion, we will use the example of a bi-propellant propulsion system to introduce a typical propulsion system layout and its operational configurations.

Bi-propellant systems are not the only propulsion system used for spacecraft. A mono-propellant system is very similar, except that only one propellant is used for the chemical reaction. This is for example the case when using hydrazine with a catalyst to activate the decomposition into gaseous products. Propulsion systems based on cold gas or electrical equipment are also in use. Their operation has some specialties, especially for electrical propulsion. The reader may refer to (Fortescue 2011) for a more in depth presentation.

6.4.2.1 Layout of a Bi-Propellant Propulsion System

In this kind of propulsion system, the thrust is obtained through the expulsion of the gas produced by a chemical reaction. In order to get a high exhaust velocity, the gas is expanded through a nozzle after the combustion chamber. Propellant liquids are stored in two separated propellant tanks and valves allow or block the flow towards the combustion chamber of the different engines so that the reaction can take place when commanded. Usually different engines are available, depending on the usage: apogee engine delivering around 400 N thrust for orbit maneuvers and reaction thrusters (between 1 and 10 N thrust) for attitude control or station keeping maneuvers.

Unfortunately a system built only on the previous elements could not work because the fluids are subjected to micro-gravity conditions in a spacecraft. A system is needed to press the fluids into the outlet of the tank. A tank filled with inert gas (typically helium) under high pressure coupled with a pressure regulator is connected to the propellant tanks. The inert gas can either be directly in contact with the propellant or separation is achieved via a bladder linked to the tank wall. The pressure regulator decrease the pressure of the inert gas to a pressure compatible with the propellant tanks characteristics (e.g., burst pressure, operational pressure) and allows controlling the fluid mass flow rate and ensures reproducible thrust conditions as long as it is in use.

All these elements are of course linked together through tubing so that fluids can flow between them. Apart from the already mentioned valve to control the flow to the combustion chambers, other valves are needed as well. Some valves are implemented to isolate parts of the system from the rest. Such valves can only be activated once (either to close or to open) and are composed of pyrotechnic devices. Release valves, that open when the pressure exceed a threshold, are used as safety to avoid high pressures in the system. Finally some valves are required to fill or drain the tanks and the tubing at the launch pad.

The observability of the system is ensured with pressure and temperature sensors together with the related electronics. The pressure regulator and the valves are commanded via the OBC. The resulting system is shown on Fig. 6.35.

6.4.2.2 Operational Configurations

After having shown an example of propulsion system layout, the first question that arises is how to operate it. Of course, operations depend on the layout itself and this chapter uses again the layout of a bi-propellant system as example.

Before a spacecraft can be operated, it has to be launched. The environment encountered by the spacecraft during launch differs drastically (e.g., accelerations, vibrations, or temperature conditions) from the one experienced during the mission. The propulsion system is configured specifically for the launch in order to avoid degradations caused by this harsh environment: closed valves first isolate the inert gas tanks under high pressure (from 250 to 300 bar) from the propellant tanks pressurized around 18 to 20 bar. Propellant tanks are also isolated from the apogee engine and reaction thrusters by further closed valves in order to avoid an unwanted firing, which would be especially critical on top of a rocket! An inert gas under low pressure (around 3 bar) usually fills up the tubing between the previous valves and the engines to keep them under pressure and minimize the risk of degradation by the vibrations. The electronics controlling the propulsion system is usually switched off during the ascent as another security measure.

After separation from the launcher, the propulsion system shall be brought into an operational state (so-called priming) before the first orbit maneuver. The logic is to put the system under increasing pressure, beginning from the engines. The filler gas between the propellant tanks and the engine is vented by opening some thrusters. Then, after closing the thruster valves again, the valve isolating the propellant from the engine is opened. Finally the valve between the high pressure inert gas tanks and the propellant tanks is opened. The complete pressurization of the system can take up to 2 h, but it can already be used under non-nominal conditions if needed, for example, for attitude control purposes or in case of emergency. Once the priming is completed, the spacecraft retains its configuration until the drift orbit (see Sect. 4.1) for a geostationary satellite or possibly the end of the mission for a LEO satellite.

The insertion into the final orbit is a delicate operation. In case of a geostationary satellite, a box of ±0.1° (around 150 km wide) around the nominal longitude is allocated and collocating more than one spacecraft at a position is common. It is thus necessary to avoid neighbor boxes as much as possible. Reaction thrusters are better suited for such maneuvers as well as for the further station keeping activities because their low thrust allows a finer control of the orbit. The apogee engine being not needed anymore, it is isolated from the propellant system by closing a pyrotechnical valve. Since thrusters require a lower mass flow than the apogee engine, the pressure regulator is not needed anymore. The inert gas tanks and pressure regulator are isolated from the propellant tanks by closing another pyrotechnical valve. All these measures are taken to ensure the safety of the spacecraft. Once these activities are completed, the so-called blow-down phase begins and the pressure within the propellant tanks will constantly decrease until the end of the mission. As a consequence, thrust performances will decrease with time. De-orbiting will be performed in this configuration.

6.4.3 Real-Time Operations

Knowledge from the two previous sections is gathered by the propulsion engineer from the spacecraft user manuals during the preparation phase preceding the launch. After launch comes the thrill of real-time operations!

6.4.3.1 Monitoring During Quiescent Periods

There is always something to do in operations, even when no activity is planned! The very first check is the limit checking. For each telemetry parameter, domains of values can be defined and flagged automatically by the telemetry processor. There are typically two types of limit domains: a warning range, flagged yellow, indicating that the values shall be monitored but that no immediate action is needed and an alarm range, flagged red, indicating a possible damage to some equipment and requiring an action. Warning and alarm domains are defined by the spacecraft manufacturer. Operations engineer, however, adapt these limits to the situation, sometimes setting them tight to be warned soon enough, sometimes loosening them when a situation is well understood and under control. Limit checking is the first easy check to get an overview of the system status. Under nominal conditions, no warning or alarm shall appear in the telemetry display system. When a warning or an alarm is raised, it is always necessary to analyze the situation and get a full understanding of what is happening before taking any action. Many automatisms on board, like FDIR, can cause warning or alarms flagging and necessitate a thorough analysis across many different subsystems.

The second monitoring covers the pressure within the entire propulsion system. When no firing occurs, the pressure should stay constant, except for the variations caused by temperature changes: as a matter of fact, gas pressure reacts to temperature changes according its state equation.^{Footnote 20} A decrease in pressure could indicate a leakage or a thruster valve that failed to close. Although a failed closing is rather obvious, leakages can be hard to detect if they are small. In this case, only an analysis over a long period of time might highlight the problem. Temperatures shall also be monitored, especially those of the thruster combustion chambers. An increase might indicate a reaction and possibly a leakage.

Another value to monitor is the time thrusters are in use (so-called on-time). This duration is usually produced by the OBC and is available in telemetry data. The more these values change, the more the thrusters are active. When an increase in the on-time values is monitored, it is always necessary to ensure the reason is understood. A leakage or a valve that failed to close can be the root cause.

Monitoring details depend of course on the spacecraft design but the previous examples give an overview of the monitoring philosophy. Whatever the combination of limit checking, long-term analysis or telemetry values, the goal is to understand what is happening within the system.

6.4.3.2 Orbit Maneuvers

Orbit maneuvers are the most important activities performed by the propulsion system. It is carefully prepared off-line (see Sect. 6.4.4.1) and its execution is considered as a critical event.

Figure 6.36 gives an overview of the pressure evolution during the second Apogee Maneuver Firing (AMF) of a geostationary mission whereas the corresponding temperature evolution is shown in Fig. 6.37. Both figures highlight the main events happening during an orbit maneuver: the maneuver starts by opening the apogee engine valves, which result in a pressure drop in the propellant tanks. This drop in pressure is caused by propellant flow towards the engine combustion chamber, which increases the space available to the inert gas pressuring and thus decreases its pressure. At the same time the helium pressure starts decreasing as a result of the pressure regulator activity, which tries to compensate the pressure drop in the propellant tanks by pumping some gas into the propellant tanks. After a short period, the pressure in the propellant tanks reaches a quasi steady state as a balance between the two flows mentioned previously. The slight increase in propellant pressure reflects the fact that the pressure regulators pump helium into the propellant tanks at a higher rate than the chemical reaction burns propellant in combustion chamber. When the engine valve is closed at completion of the orbit maneuver, a sharp rise in pressure is observed in the propellant tanks. This results from the stop of the propellant flow while the pressure regulator is still pumping gas into the propellant tanks. Afterwards the pressure in the tanks will increase until the set point of the pressure regulator is reached.

The pressure regulator temperature increases at the beginning of the maneuver. This is due to the Joule–Thomson effect: helium has a negative Joule–Thomson coefficient at the operational temperature, which means that the gas warms up when expanded (from 150 to approximately 18.5 bar during this maneuver, as shown on Fig. 6.36) in the pressure regulator. Later on, the pressure regulator temperature decreases because of the pressure drop in the helium tank, which leads to a decrease of the helium temperature.

The temperature measured at the inlet of the combustion chamber first decreases because of the propellant flow and then reaches a steady state. As expected, the temperature close to the combustion chamber rises due to the strongly exothermic chemical reaction. More surprising is the sharp rise of temperature at completion of the orbit maneuver: during the maneuver, the exhaust flow takes away a part of the thermal energy produced by the chemical reaction by convection. When the engine valve is closed, the flow stops and the thermal energy can only be evacuated by radiation and conduction. Since the radiation depends on the temperature, the heat quantity evacuated by this mechanism remains relatively constant at first. Consequently the heat starts flowing back into the relatively cold spacecraft by conduction: this is called the “heat soak-back effect” leading to an important increase of temperature (more than 350 °C close to the combustion chamber) in the spacecraft around the apogee engine. A shield is usually installed around the engine to minimize the effect on the internal equipment.

Another phenomenon that can occur is propellant sloshing in the tanks. Sloshing depends on the propellant mass and the space being available to move freely. It is consequently reduced during AMF1 because the tanks are almost fully filled and after AMF2 because the propellant mass left is low. Sloshing effects are best monitored in the pointing error of the spacecraft at beginning of the maneuver.

Due to the criticality of an orbit maneuver, it is important for a propulsion engineer to assess quickly whether it is performed nominally or not. This is especially valid at the beginning and the end of the maneuver. Nominal start of maneuver is first detected in the attitude system, where the spacecraft rates reflect the engine start. The thermal system can also confirm correct start by monitoring the temperatures. Finally the propulsion engineer also confirms the start by looking at the valve status. The end of the maneuver is more critical because a failure at engine valve closure could lead to a premature end of mission. The same systems as previously can confirm a nominal end of maneuver, the heat soak-back and the rate stabilization being the major indicators. The propulsion engineer shall, however, monitor closely the pressure in the system for a certain duration to ensure no leakage has buildup.

The effects described in this section are quite patent for engines producing a high amount of thrust like the apogee engine. For reaction thrusters, some effects might become so tiny that they cannot be observed.

For other technologies, a preparation time is sometimes necessary and shall be taken into account when planning the orbit maneuvers. It is for example necessary to preheat the catalyst of a mono-propellant system with hydrazine to avoid degradation. The same preheating time is necessary for the neutralizer of electrical engines. In case of electrical propulsion, the power balance and the battery status are to be checked carefully before starting the maneuver.

6.4.3.3 Isolation of Apogee Engine (GEO)

As mentioned in the section about the operational configurations, the apogee engine is isolated from the rest of the system for safety reasons after reaching the drift orbit. Pyrotechnical valves can only be moved once and irreversibly so it is necessary to ensure the apogee engine will not be used anymore. This confirmation is gained from a precise orbit determination, which shall demonstrate that the remaining ΔV required to park the spacecraft into its box can be achieved by the using reaction thrusters only. GPS are currently not used on-board geostationary satellite because their orbit is above the GPS constellation, leading to difficulties in acquiring constant signals. Orbit determination must then rely on ranging data (see Sect. 4.1, especially Figs. 4.17 and 4.18). Moreover Doppler data is not of much help because the drift orbit is close to circular and the radial velocity small. In order to improve the orbit determination, ranging data is acquired alternatively from two ground stations with enough separation in longitude.

The isolation closes the supply of inert gas into the propellant tanks. From this point on, the inert gas pressure in the propellant tanks will decrease until the end of the mission. Sometimes, the spacecraft manufacturer may decide to optimize slightly the thruster performances, which depend directly on the pressure of the inert gas within the tanks. This is achieved by switching off the tank heaters to cool down the propellant and the inert gas. The propellant volume does not vary much during this operation so that the inert gas volume remains almost constant. Consequently a decrease in temperature results in a decrease of pressure, which is compensated by the pressure regulator: this trick allows getting a higher pressure of the inert gas within the propellant tanks after reactivating the thermal control. It is finally important to record carefully pressure and temperatures within the entire propulsion system just after isolation for the purpose of mass calculation and lifetime estimation (see both sections under off-line operations).

6.4.3.4 Autonomous Operations

Orbit maneuvers, either performed with the apogee engine or the reaction thrusters, are performed by directly commanding the opening and closing time of the engine valves. Reaction thrusters create a force on the spacecraft, which can be used for attitude control when its direction does not go through the current center of mass. If this is the case, the thruster also generates an external torque, which can be used to control the spacecraft attitude or its angular momentum.

Due to the complexity of the attitude motion (see Sect. 4.2.5), the Attitude and Orbit Control System (AOCS) usually controls autonomously the thruster firings. In case the AOCS controller aims at rotating the spacecraft, the thruster firings are combined so as to result in a torque around the desired axis, with the desired magnitude. The torque obtained with reaction thrusters can be used to control the spacecraft angular momentum. This is especially interesting when a reaction wheel assembly is used to control the attitude. As a matter of fact, this assembly stores the angular momentum from external perturbations, which cause the wheel to reach their saturation speed. Reaction thrusters help desaturating the wheels the same way magnetic torquers do. This activity is usefully combined within station keeping maneuvers to take advantage of the resulting force on the spacecraft.

During such autonomous operations, monitoring is more qualitative and based on physical sense. For example the run-up of a momentum wheel is counteracted by thruster firing to keep the platform orientation steady. The propulsion engineer shall check whether the thruster activity displayed by telemetry data actually corresponds to a torque along the axis of the momentum wheel.

6.4.4 Off-line Operations

The real-time operations described previously require some preparation work and post-performance analyses. Such activities are referred to as “off-line” as opposed to the actual operations.

6.4.4.1 Preparation and Calibration of Orbit Maneuvers

The preparation of orbit maneuver involves three parties: a flight dynamics engineer who specifies the required ΔV and the center of burn (time of apogee crossing from orbit determination), the propulsion engineer who provides the spacecraft mass, and the propulsion expert of the satellite manufacturer who provides corrections based on flight experience.

The thrust direction is tangential to the orbit at the apogee, which can be translated into a spacecraft attitude during the orbit maneuver. Flight dynamics experts provide the commands for the reorientation as required by the spacecraft AOCS. The ΔV and the center of burn depend on the other purely on the current and final orbits. These quantities shall be translated into start and stop times by taking the amount of thrust the apogee engine can actually deliver. Neglecting the gravity with respect to the thrust and assuming a constant specific impulse, the ideal rocket equation [see Eq. (6.9)] yields:

$$ {m}_{\mathrm{f}}={m}_{\mathrm{i}}-\Delta m={m}_{\mathrm{i}}{e}^{-\frac{\Delta V}{g_0{I}_{\mathrm{sp}}}} $$

of

$$ \Delta m={m}_{\mathrm{i}}\left(1-{e}^{-\frac{\Delta V}{g_0{I}_{\mathrm{sp}}}}\right). $$

(6.10)

Knowing the initial mass, provided by the propulsion engineer from its mass calculation records (see Sect. 6.4.4.2 further), and the specific impulse one can compute how much propellant mass will be used during the maneuver. The knowledge of the expected mass flow rate $ \frac{\mathrm{d} m}{\mathrm{d} t} $ allows ultimately computing how long the burn shall last. Both the mass flow rate and the specific impulse depend on the pressure and temperature within the propulsion system. Their mathematical expression is fitted to on-ground tests results, for example, as a polynomial or in form of tables, and is given in the spacecraft user manual. The propulsion engineer can provide the current pressure and temperature values and thus help computing an estimate of the burn duration. However, this estimate would not be accurate because the pressure and temperature values needed are the not current ones, but the ones during the maneuver! Moreover Fig. 6.36 shows that the pressure in the tank drops during the maneuver and this pressure drop varies with the tank filling state. Finally the pressure does not remain constant during the maneuver but increases slightly over time as shown on Fig. 6.36. At this point, the propulsion expert of the spacecraft manufacturer can help by providing more accurate data based on flight experience, usually in the form of a mean thrust level to be expected. Once the maneuver duration has been computed, the start and stop times are easily deduced from the center of burn time.

Previous computations are additionally complicated by the fact that the reaction thrusters are also used for attitude control. The thrusters are activated autonomously by the AOCS control to create torques required to keep the apogee engine aligned with the desired thrust direction. These torques result from forces not going through the center of mass, but these forces also contribute to the ΔV in an unpredictable way! The gravity, which has been neglected in the previous computations, also affects the maneuver performance as it curbs the orbit (see gravitation losses), especially for long maneuvers. It is consequently necessary to calibrate the orbit maneuver after its performance. Precise orbit determination yields the actually achieved ΔV: it is then possible to compute a correction factor (for example on the mean thrust level) that will be taken into account for the preparation of the next maneuver.

6.4.4.2 Propellant Mass Calculation

The previous section showed clearly the need to know the spacecraft mass. It can be divided into the dry mass covering the spacecraft equipments and the wet mass that comprises the propellant and different gases used in the propulsion system. The dry mass is measured accurately on ground before launch. The wet mass on the other hand is known at launch from the filling of the tanks. The wet mass decreases as propellant is burnt and this mass cannot be easily measured directly. As a matter of fact, a direct measure of the remaining propellant mass is complicated by its distribution within the tank, which is governed by the propellant surface tension under microgravity conditions. This is the reason why the remaining propellant mass is usually estimated by two complementary methods.

The first method is based on the thermodynamic properties of the inert gas used to pressurize the propellant tanks. It uses pressure and temperature measurements available in telemetry data to compute the volume occupied by the gas from its state equation. A simple subtraction from the tank volume yields the propellant volume and the propellant density ultimately allows computing the mass. These quantities explain the name of PVT (Pressure–Volume–Temperature) given to this method. Although the principle is straightforward, different effects shall be taken into account to get a correct accuracy. First of all ideal gas law does not hold accurately at pressures above 5–10 bars and it is necessary to resort to more complicated state equations. A practical way is to introduce a correction factor Z(P, T) such that the state equation now reads PV = ZnRT. Values of the correction factors are then provided for the operational range of pressure and temperature, either as a function or as table. A liquid evaporates and its vapor mixes with the gas used to pressure the propellant, leading to a change in the tank pressure. The effect of this gas mixture on the measured tank pressure is sometimes taken into account. Moreover gases dissolve themselves into liquids and shall be accounted for when computing the number of moles n. One can finally mention the dependency of the propellant density with the temperature and the expansion of the tanks under pressure. All these effects may seem so small they could be neglected, but it will be seen that the accuracy of the thermodynamic method is closely related to EOL, which justifies taking these effects into account. Another pitfall of the PVT method is the activation of relief valves when the pressure in the system becomes too high. If this happens, it is necessary to estimate how much gas escaped from the system.

The second method is based on the knowledge of the propellant mass flow rate inside all engines. As for the correction factor introduced previously for real gas, the mass flow rate of an engine is measured on ground and provided to the propulsion engineer as a function of pressure and temperature whose coefficients are specified or as a table. In any case, the knowledge of the mass flow rate allows computing the propellant mass used by the engine by integrating it over the maneuver time. The remaining propellant mass is then simply computed by subtracting the mass used during engine activation to the mass present before the activation. Due to this accounting of all the mass used during the actuations, this method is called “bookkeeping.”

Having two methods is a good way to cross-check computations. They, however, rarely agree and the difference can be in the range of 10 kg at EOL! The bookkeeping method is more accurate than the thermodynamic method on the short term. The latter has an accuracy determined by the accuracies of the involved sensors and the underlying thermodynamic model. The bookkeeping method on the other hand is applied to every maneuver and inaccuracies add up over time. Which of both methods has the better accuracy, especially at EOL shall be carefully analyzed by the satellite manufacturer.

Another method based on measuring the thermal capacity of a propellant tank has emerged in the last decade. The thermal capacity depends on how much propellant is left in the tank and can be estimated by measuring the tank temperature response to a controlled heating. This estimation, however, requires modeling the propellant tank, the location of the probes, and the location of the temperature sensors. This method has the advantage to be more accurate when the remaining propellant mass decreases.

6.4.4.3 Center of Gravity Calibration

Mass calculation is closely related to the position of the spacecraft mass center and the inertia tensor. Both are used in the attitude control algorithms and are parameters loaded in the SGM of the satellite. Due to the mass consumption by the propulsion system, it is often necessary to update the values of these parameters.

Some spacecrafts, like the spacebus 3000, cope with this issue by setting the value of a predefined index once per year. This index corresponds to a predefined position of the center of mass and is used as input by the AOCS. Values are chosen such that it approximates the nominal propellant consumption over a year, but it might be necessary to choose the value differently, in case the spacecraft had an anomaly or needed to be repositioned at another orbital position for example.

The GRACE mission has particularly high requirements about the knowledge on the center of mass position. This mission is composed of two satellites separated by around 220 km. A microwave link between the two satellites allows observing the earth gravity field. It is, however, necessary to filter out nongravitational accelerations, which is achieved with an accelerometer. In order to minimize accelerations resulting from satellite rotation, the center of mass is kept fixed with respect to the spacecraft structure by moving small masses around the satellite. Due to the required accuracy, dedicated attitude maneuvers around the three axes of the spacecraft are commanded regularly to accurately calibrate the center of mass position. After an off-line analysis of the results, the positions of the small masses are commanded such that the center of mass remains at its allocated position.

6.4.4.4 Lifetime Estimation

A mission is very often put to an end not because the payload is not functioning properly, but rather because propellant runs out! Since debris are a growing concern, spacecraft operators are more and more required to leave useful orbits (LEO or GEO) and put their property either into graveyard orbits or de-orbit it into the atmosphere. The propulsion engineer plays an important role in this decision because his/her mass estimation, taking into account de-orbiting maneuvers, is an important input to call the end of mission. It adds to the necessity to know which of the mass calculation methods shall be trusted for this decision. However, pressure is high to postpone the EOL and “push the envelope” as much as possible.

De-orbiting maneuvers are computed by flight dynamics experts. Due to almost full depletion of the propellant tanks or postponing the EOL more than expected, it can be difficult to predict the amount of thrust that will be produced. As a matter of fact, bubbles of pressuring gas can degrade the combustion and result into non-nominal performances.

6.5 Attitude and Orbit Control Subsystem Operations

Ralf Faller

German Aerospace Center (DLR), German Space Operations Center (GSOC), Oberpfaffenhofen, 82234, Wessling, Germany
Ralf Faller

This chapter will give a general overview of the attitude and orbit control subsystem, its components, and the operational tasks to be performed by the ground control personnel. It will complement the basics of attitude and orbit control explained in Sect. 4.1.

After a short introduction and an outline of its relevance for different needs coming from other subsystems and the payload, an overview of the subsystem is given in Sect. 6.5.2, where its components and most common applications will be described and the basic functions of the on-board control will be explained. With this background, Sect. 6.5.3 will summarize the tasks for the ground control team during different mission phases. Some lifetime experiences in different missions will be reported in Sect. 6.5.4. The AOCS topic is finally summarized in Sect. 6.5.5.

6.5.1 Introduction and Overview

The AOCS is one of the main subsystems responsible for providing both favorable conditions for other satellite subsystems and the payload with respect to attitude and orbit.

Attitude comprises two aspects: The first is the orientation of the spacecraft with respect to reference objects or directions, e.g., earth, sun, stars, flight direction, etc. The attitude accuracy requirements encompasses the full range of levels, from a rough orientation of a satellite towards the sun for sufficient power supply to the order of some degrees, to high precision orientation tasks down to the order of arc seconds, e.g., for orientation of an astronomical telescope towards dedicated targets. The second aspect of attitude control is its dynamic. Some satellites need to change their orientation from time to time, have to rotate about dedicated axes (e.g., daily pitch rotation of geostationary satellites), or need to stabilize their orientation after separation from the launcher. Thus rotation and rotation rate control are tasks of the attitude control.

Orbit control comprises all aspects of maintaining or acquiring a target orbit. Geostationary communication satellites have to be positioned on the GEO and need to be kept in their control boxes during the whole lifetime for adequate payload support. In the same way, all kinds of LEO satellite missions need to acquire and maintain their target orbits, have to maintain formations, or need to change orbits depending on the mission purpose. Another aspect is the avoidance of collisions with other objects. In times with a more and more crowded space, this topic is relevant for both manned and unmanned spaceflight missions.

Altogether, maintaining attitude and orbit are tasks which are provided by the corresponding control system. The on-board control itself is realized by three main instances. The data about the current attitude and orbit are received by sensors in form of aspect angles, spin rates, or position measurements. These data are collected by a control unit, which derives corresponding attitude and orbit-related parameter. By comparison with nominal values, deviations are determined and correction (control-) demands are generated. These control demands are sent to Actuators, like thrusters or other equipment generating control torques and forces, which correct the attitude or orbit. Figure 6.38 illustrates these main components of the on-board control cycle.

Attitude control is done via a classic on-board closed-loop control. The ground can adjust control settings and margins or can change control strategies (see attitude modes), but the control loop requires short round-trip times of the control signals and, thus, the loop is always closed on board.

Orbit control works partly different. Orbit correction maneuvers are normally done at discrete times and not permanently. The current orbit is measured and calculated, either on board using global positioning data (e.g., GPS or Galileo) or classically on ground using station tracking information. The decision for and the preparation of an orbit maneuver is done on ground, then commanded to the satellite, and finally executed by the S/C at the dedicated maneuver time. There are normally no real-time requirements for the control loop. Only missions with permanent orbit control demand (e.g., rendezvous and docking situations) need to have an on-board closed-loop control.

6.5.2 Subsystem Description

With the basic understanding of the attitude and orbit control described in Sect. 6.5.1, this chapter will give an overview about most common sensors and actuators, and will describe the typical functions of the control unit. The descriptions only focus on the main aspects.

6.5.2.1 Sensors

The main task of sensors is the measurement of S/C position, orientation, and dynamics mainly w.r.t. celestial or other reference objects. The output of these sensors might be S/C position and velocity vectors, attitude aspect angles, rotational rates, or inertial orientations. Whilst orbit-realted data are given with respect to earth-related coordinate systems (e.g., ECEF), attitude measurements are typically provided with respect to reference axes of the sensor system or the spacecraft body. Depending upon which kind of information is used, attitude information about one, two, or all three axes is provided. The following list of typical sensors gives a brief overview.

6.5.2.1.1 Sun Sensor

This group of optical sensors is most commonly used for spaceflight applications. The brightest object in our solar system represents an unambiguous orientation source. Different technical solutions are available to provide sun direction data with an accuracy between a few degrees in case of simple safe mode sensors and better than 0.05°. Another main characteristic is the large field of view of a single sensor head, ranging in the order of ± 60–90°. Shading of the sunlight by other objects (e.g., eclipse phases by earth or moon) need to be operationally considered. For some sun sensor models, the earth albedo might reduce the attainable accuracy. Since the sun is rotation symmetric for more or less all sensor applications, only 2-axes attitude information can be obtained (Fig. 6.39).

6.5.2.1.2 Earth Sensor

Classic earth sensors are providing direction information by scanning the infrared disk of the earth. They are commonly used for earth-related missions with medium pointing accuracy requirements, like geostationary communication satellites. These sensors could be disturbed by other infrared objects like the sun or the fully illuminated moon, which need to be respected by the flight operations.

Other earth sensor applications are available using imaging systems (cameras). In addition, combinations of sun and earth sensors have been developed. Such sensors consist of thermistor elements providing coarse direction data of both celestial bodies.

6.5.2.1.3 Star Sensors

This class of optical sensors is using stars as orientation source. Different to earth or sun sensors, star sensors provide an inertial attitude reference about all three axes. The attainable accuracy is in the order of arc seconds. Disturbance by sun or moon blinding is possible and is normally respected per satellite design by implementing 2–3 sensors in different directions (Fig. 6.40). See also Sect. 4.2.

6.5.2.1.4 Magnetometer

The earth magnetic field can also be used as an orientation source. Magnetometers are measuring the direction of the local magnetic field lines and, thus, provide a fair 2-axes attitude reference. Fairly accurate mathematic models are available, but the earth magnetic field is influenced by sun activities and, thus, magnetometer measurements are seldom input for attitude determination calculations. Nevertheless, magnetometers are commonly used in combination with magnetic torque rods to provide attitude control torques.

6.5.2.1.5 Gyroscopes

Gyroscopes are measuring spacecraft rotation rates. Compared to the sensors described so far, gyros are providing relative attitude information. They are mainly used to get data about attitude changes and, therefore, allow to cover phases with reduced absolute sensor data availability (e.g., during eclipse phases or slews from one orientation to the next). All kinds of gyros have a drift, which cause accumulative rate integration errors over time.

6.5.2.1.6 Space-Based Satellite Navigation Systems

Satellite navigation systems, like the Global Positioning Systems GPS (others: GLONASS, GALILEO), can be used to gather position (and velocity) data of LEO missions. These data are input for on-board navigation systems, which perform orbit determination tasks in space. In addition, specially equipped GPS systems can be used for attitude determination, preferable for larger spacecraft.

6.5.2.1.7 Other Sensors

Besides these common sensor systems described above, a few other sensor concepts might be in use. As an example, Radio Frequency Beacon sensors are mentioned here. They are using RF sources on ground as orientation reference with an accuracy of order 1 arc minute.

6.5.2.2 Actuators

The change of the spacecraft’s velocity or its rotational rates can be realized by different actuator systems generating the required control torques and forces.

6.5.2.2.1 Thrusters

Thrusters are the classic equipment for both attitude and orbit control. Depending on the spacecraft’s complexity, they are sometimes part of a separate subsystem as described in detail in Sect. 6.4, but activity demands are always generated by the AOCS subsystem. Since the amount of fuel aboard a spacecraft is limited, the availability of all thrusters systems is limited correspondingly.

6.5.2.2.2 Magnetic Torquer

These actuators are using the effect of the interaction with the magnetic fields. Electric magnets aboard a spacecraft, so-called magnetic torquer rods, can generate control torques by interacting with the earth magnetic field. By mounting 3 torquer rods in the 3 body axes of the spacecraft, control torques about 2 axes can be achieved rectangular to the local magnetic field lines only. However, this can be compensated using the change of the earth magnetic field vector over an orbit. Different to thrusters, magnetic torquer is available as long as electric power is available. They are provided in two different applications, torque rods with an iron core and air coils (Fig. 6.41).

6.5.2.2.3 Wheels

In principle, a reaction wheel consists of a rotating mass attached to an electric motor. By increasing or decreasing its rotational speed, the angular momentum of the mass increases or decreases. Due to the law of conservation of momentum, the total angular momentum of the spacecraft remains constant as long as no external torque is applied. As a consequence of speeding up the motor of the reaction wheel and the corresponding increase of its angular momentum, a reverse-directed momentum is applied to the satellite’s structure. This effect can be used for the attitude control. Different to thrusters or magnetic torquer, the angular momentum of the whole system is not changed. Angular momentum is only shifted between the spacecraft body and the wheel.

Two different types of wheels are available, reaction wheels with nominally zero speed and momentum wheels, so-called fly-wheels, running on a high speed. The latter kind of wheels is also used to store a portion of angular momentum in the spacecraft in order to provide some dynamic stiffness against external disturbance torques.

Due to friction effects or systematic external disturbance torques, wheels need to be de-saturated from time to time when their maximum speeds are reached. This is called “wheel unloading” or “wheel desaturation.” Therefore, purposeful torques are generated using thrusters or torquer, which can be compensated by the wheel by reducing its speed (Fig. 6.42).

6.5.2.3 On-Board Control Unit

The on-board control unit is the central element of the AOCS. It can be a separate piece of hardware or a dedicated process running on the board computer. The main tasks of the AOCS control unit are:

Calculation of Current Attitude and Prediction

All sensor measurements are used to calculate the current S/C attitude, rotation rates, and their deviations from nominal values typically by means of numeric filtering (e.g., Kalman filter). In addition, the development of the parameters for the next control grid point (see Sect. 4.2.3) is also predicted.
Examples for such attitude parameter are the sun aspect angle for sun-pointing spacecraft or errors in roll, pitch, and yaw in case of an earth-oriented geostationary satellite.

6.5.2.3.1 Generation of Control Arguments for Attitude Correction/Adjustment

Using the predicted attitude deviations, control demands are generated, like speeding up or down of a corresponding reaction wheel, on/off switching of magnetic torquer, or firing of selected thrusters in order to get a desired attitude change.

Wheel Unloading

As mentioned above, wheels need to be saturated from time to time, when they reach its maximum speed (typically a few thousand RPM). Continuous wheel unloading is also possible.
This is process is completely controlled by the AOCS without ground support.

Calculation and Prediction of Orbit-Related Data

Spacecraft equipped with an on-board navigation system are calculating the orbit using GPS measurements.

Error Detection and Reaction

Early detection of problems within the AOCS and autonomous reaction of the spacecraft without immediate activities by the ground control is a mandatory function for all kinds of spacecraft. This is realized by respective FDIR mechanism.

6.5.2.3.2 AOCS Modes

More or less all spacecraft have different operational states, so-called operational modes. By selecting a specific mode, different settings and preselection are used for the attitude control. The most relevant settings are:

Selection of the Control Strategy

For example switching into a sun-pointing mode sets the sun as main orientation reference; the spacecraft will orient itself relative to this direction.

Setting of Control Ranges and Limits

For modes with high attitude accuracy requirements, the control margins are kept narrow, whilst for modes like a safe mode, only a coarse attitude is needed and the control margins can be set to a larger interval.

Preselection of Needed Sensors and Actuators

The equipment required for the corresponding mode is activated, others are switched off. For instance, a star sensor would be switched on for a mode with high pointing accuracy, but deactivated in safe mode.

Selection of FDIR Strategies

This means enabling or disabling of predefined reactions on potential malfunctions.
Table 6.5 shows some example AOCS modes and corresponding settings.
Table 6.5 Example AOCS mode
Full size table

6.5.2.3.3 Sub-Modes

Each mode might have different states, so-called sub-modes, to allow tiered activities and working levels. As an example, Fig. 6.43 shows sub-modes of a simple sun-pointing mode. The lowest one is a rate damping state, where only the rotational rates of the spacecraft are dumped to low levels in order to provide adequate conditions for the attitude measurement. Being the default entry state after invoking the sun-pointing mode, this sub-mode is mainly defined for the first sun orientation after separation from the launcher, when the spacecraft was put into some high spin rotation. When the rates are low enough, the on-board control changes to the search sub-mode. Here, the mode logic checks, if the sun is already in the sun sensors field of view. (Of course this sub-mode does not make sense for spacecraft with an overall field of view). If the sun sensors do not provide a sun presence (SP) signal, the spacecraft starts rotation about 1 or 2 body axes to bring the sun into sight. When a valid sun presence signal is available, the acquisition sub-mode orients the dedicated spacecraft body axis towards sun. As soon as this has been accomplished adequately, the highest sub-mode is invoked. Here, a slow spin about the sun orientation is applied providing some passive attitude stabilization.

6.5.2.3.4 Fault Detection, Isolation, and Recovery

FDIR routines and functions are a key element of the AOCS. Whilst other subsystems normally have longer response periods until a problem becomes severe, failures in the AOCS control cycle might immediately lead to loss of the correct attitude and possibly to bad thermal and power conditions or to a loss of the communication link. Therefore, autonomous reaction strategies of the on-board control are implemented for various error cases. A key element of these FDIR routines is the adequacy of the reaction with respect to the occurred problem. For instance, a minor glitch in a sensor system might not need to send the complete spacecraft into safe mode, which would cause a payload shutdown and a major disruption of the current mission activities. A simple switchover to the redundant sensor would be more suitable and would allow maintaining the current activities. For adequate reactions, different error levels and corresponding reactions are defined. Table 6.6 gives some exemplary error levels and corresponding reactions for a scientific LEO satellite mission.

Table 6.6 Examples of possible error levels and adequate FDIR reactions

Full size table

6.5.2.4 AOCS Equipment Combinations and Redundancy

As described in the previous sections, different sensors and actuators are available with various technical realizations and performance levels. Table 6.7 shows sample combinations of sensors and actuators. For three different kinds of missions, the equipment is labeled as most suitable (++), suitable (+), or not suitable (−), but other combinations are possible too and also depending on mission constraints, the project budget, and other S/C design drivers. For instance, thrusters are the main actuator for orbit control, but could not be used for scientific mission with sensitive sensor systems, since the exhausted gases of the thrusters would produce some kind of pollution of the space around the spacecraft.

Table 6.7 Possible sensor/actuator combinations

Full size table

Besides the selection of adequate sensors and actuators, the number of units per category is another relevant aspect for the operations. As for other unmanned spaceflight applications, a single failure tolerance is normally achieved by using two pieces of equipment, one being active and in control, and the other one switched off and available as cold redundancy. Fig. 6.44 shows an example of a functional AOCS block diagram for a geostationary communication satellite. For each kind of sensor, a redundant one is available. Also available is a second control unit. In case of a loss of one of the wheels, a redundant fly-wheel is available. In this example, the thrusters are covered by a separate subsystem.

6.5.3 AOCS-Related Ground Operations

6.5.3.1 Basic AOCS Ground Activities

This section describes common tasks and responsibilities of an AOCS engineer during all mission phases. As for all other satellite subsystems, flight procedures shall be available for the AOCS in order to provide a reliable basis for flight operations.

6.5.3.1.1 Monitoring

The most common ground activities are all kinds of monitoring and analyzing of the subsystem functions, equipment, and performances. In more detail, AOCS monitoring comprises the following items:

Check of Current Status

The subsystem status is provided by the AOCS mode and sub-mode. Error words or flags, triggered FDIR actions, often in combination with spacecraft event messages, are an indication of problems detected by the AOCS. In case of anomalies or FDIR activities, routine activities change to contingency operations (see Sect. 6.5.3.3).

Verification of Equipment Health and Performance

These more specific checks comprise on/off settings, status, and health information of sensors and actuators. Direct readings of sensors and duty cycles of the actuators, like wheel speeds, magnetic torquer activities, and thruster on-times provide a first guess of the AOCS performance.

Current Attitude

This expression means the attitude solution, as calculated by the on-board control, which respects all sensor inputs. Major deviations between calculated and expected attitude are a direct indication of attitude control problems, if not already triggered by FDIR mechanisms.

Monitoring of Orbit

For spacecraft equipped with satellite navigation systems (e.g., GPS), the current orbit measurements are monitored. Typical parameters to be checked are number of tracked satellites and availability of position and velocity solutions. If on-board routines for further processing of these data are available, their functioning is observed.
These checks and analysis mentioned above are performed typically during a contact with the spacecraft by observation of incoming real-time telemetry. Main tool for real-time monitoring is the display system providing corresponding display pages. Figure 6.45 is an example of common sensor-specific telemetry.
Fig. 6.45
Classic alphanumeric and graphical display pages for AOCS. Whilst alphanumeric pages only give a snapshot of a status, plots allow observing parameter behavior over time, which is most useful for dynamic AOCS parameter, like angles, rates, momentum, etc.
Full size image

Another valuable monitoring method is the analysis of recorded (off-line) data. Off-line checks and analysis allow monitoring of the subsystem over longer periods. In addition, long-time analysis of equipment telemetry might indicate evolving problems or anomalies (e.g., increase of wheel friction torques due to degradation or aging effects, change in data noise of mechanical gyros, etc.).

6.5.3.1.2 Support of Orbit and Attitude Maneuvers

The AOCS engineer supports all kinds of orbit and attitude maneuvers. For maneuver preparation (e.g., station keeping maneuver for geostationary satellites or orbit correction maneuver for LEO missions), he works in close contact with the flight dynamics engineer. During routine phases, maneuvers and corresponding command lists are mainly planned and prepared by mission planning systems or flight dynamics tools.

If real-time telemetry is available, the maneuver execution and the corresponding performance of the AOCS are monitored. Otherwise, off-line telemetry is analyzed afterwards.

6.5.3.1.3 Miscellaneous Activities

Depending on the mission and spacecraft design, additional tasks are in responsibility of the AOCS engineer. Some typical tasks are mentioned here:

Routine Update of Reference Data

On-board navigation systems for orbit determination sometimes require periodic updates of reference data (e.g., two-line elements) as fallback option in case of missing GPS measurements.

Sensor Interferences

For LEO missions, sensor interferences normally do not require special activities by the ground personnel, but for some GEO satellites, interferences of the earth sensor by sun or moon need to be handled. The standard measure to avoid interferences is to disable the corresponding sensor head, when sun or moon comes into its field of view. Such head switching is done either manually via time-tagged commands (in case of moon events), or automatically by on-board routines (in case of sun events). In both cases, the ground personnel monitor these events.

Eclipse Phases

As in case of sensor interferences, eclipse phases are normally only a topic for GEO missions. Some GEO satellites need to be configured for each eclipse phase and will be monitored by ground personnel during the event.

6.5.3.2 LEOP and IOT

The LEOP phase is the most intense phase for AOCS engineers. The engineer has to perform all of the tasks, as described in the basic activities section. Beyond, he is also responsible for:

First Attitude Estimation After Separation from Launcher

Receiving the first telemetry from the satellite, the AOCS engineer performs a quick subsystem checkout. LEO satellites normally invoke their attitude control shortly after board computer start-up and it depends on the first ground station visibility, if this can be monitored in real time by ground personnel. For GEO missions, even when they are put into a GTO first, real-time telemetry is often available shortly after separation. So, the AOCS engineer can check the separation attitude. The AOCS activation and all further steps are done ground controlled.

Support of Orbit and Attitude Maneuvers

All orbit and attitude maneuvers, performed the first times, are prepared thoroughly, monitored in real time, and analyzed and calibrated afterwards. For GEO missions starting in a GTO, this comprises also the execution of apogee boost maneuvers.

In-Orbit Tests

Before the mission goes into its routine phase, the spacecraft and its payload are tested and calibrated beforehand. Tests of the AOCS comprise checkouts of sensor orientation and field-of-view measurements, calibration of sensors (e.g., drift compensation of gyroscopes), tests of redundant equipment, and actuator checkouts. It depends on the mission, what kinds of tests are foreseen. Customers who ordered a satellite delivered in space often request testing all redundant equipment (all sensors and redundant actuators) in order to get the confirmation that all components, they pay for, are available. Other missions prefer leaving redundant components off until they are really needed.

6.5.3.2.1 Payload Checkouts

Checkouts and IOTs are also supported by the AOCS engineer if required. Communication satellites often perform an antenna mapping during the IOT, where the ground “footprint” of the payload antennas is measured. Therefore, a single ground station is measuring the downlink power, whilst the whole GEO satellite is turned systematically by a few degrees about roll and pitch axes, covering the area of the ground footprint. Figure 6.46 shows an example of a TV satellite’s footprint.

6.5.3.3 Contingency Operations

This kind of operations generally comprises the handling of abnormal behavior or malfunctions of the AOCS. Such anomalies are either detected by the spacecraft autonomously via FDIR tasks or discovered by the ground personnel. The most common tasks of the AOCS engineer in contingency situations are:

Error Detection and Analysis

Most contingency situations start with analysis of error bits/flags, event messages, and triggered FDIRs. Since the root cause of a problem is not always clear right from the start, evaluation of real-time and history telemetry might be needed. Corresponding contingency procedures should be available to support such analysis.

Reconfiguration After FDIR Cases

If a problem is sufficiently analyzed, it might be needed to reset equipment selections to nominal settings (e.g., after triggered error and automatic switch to redundancy), when corresponding equipment was declared as o.k. and operational. In addition, error counters and FDIR mechanisms are reset again.

Change to Redundant Equipment

Manual switching of sensors or actuators to the redundant equipment might be needed, when long-time analysis and specialists appraisal recommend changing it preventively, before a real problem occurs.

AOCS Recovery

In case of major anomalies, when a spacecraft was put into a safe mode, it might require extensive recovery activities, until payload operations can be resumed. Geostationary satellites are good examples for these recoveries. When they were put into a sun-pointing safe mode, it needs hours of operational work and a considerable amount of fuel, until the spacecraft is back in 3-axes stabilized orientation.

AOCS Software Maintenance

In some cases, a problem solution might include an update of the on-board software. The loading of S/W upgrades and patches itself is normally not a critical task, but the activation of it often requires full attention of the ground control team. Typically, some follow-on testing sessions are mandatory.

6.5.3.4 Support Tools for AOCS

For AOCS flight operations, a multiplicity of tools and software modules might be developed in order to support the engineer’s daily business. The scope of these tools ranges from simple tools for quick solutions or estimations to complex and fully developed software systems. The technical realization is depending on the mission, spacecraft design aspects, and operational needs and constraints. Some typical AOCS tools are listed here:

Reference Parameter Calculation for Attitude Maneuvers

These tools are used to calculate parameter for upcoming attitude maneuvers, which are input for corresponding flight procedures. A typical example for GEO missions is the transition from sun pointing to earth pointing orientation. Therefore, some simplified orbit parameters for the epoch of the planned mode transition are calculated on ground and then sent to the satellite. For some LEO mission, lists of attitude quaternions for a time period are calculated to provide a dedicated attitude profile.

Gyro Calibration

For the drift estimation and compensation of gyroscopes, a ground calculation might be needed. Therefore, gyro measurements over a corresponding period are collected and a drift is estimated on ground.

Attitude Determination

A classic application for AOCS engineers are attitude determination tools, which either allow a rough order of magnitude estimation of the current spacecraft orientation or perform a high accuracy attitude determination by processing larger amount of telemetry data.

6.5.4 Experience from Previous Missions

This section illustrates some examples of an AOCS engineer’s experience.

6.5.4.1 AOCS Degradation

The very successful multinational (USA, UK, Germany) ROSAT project is a good example, how long successful mission operations could be conducted in spite of degradation and loss of equipment. Figure 6.47 shows the layout of the attitude measurement and control system (AMCS) at begin of the mission and at the end.

After a short LEOP and commissioning phase, the mission started in 1990 with a systematic mapping of the sky for X-ray sources, followed by a pointing phase where selected objects were observed. Over the years, some sensors degraded and failed at the end, but all of these losses could be managed by updating and adjusting the AMCS software. Even after loss of both star tracker cameras, the mission was not over. It could be realized to bring a part of the payload instruments into the attitude control loop. Therefore, also parts of the satellite OBDH needed to be changed. After implementation of the change, some successful data takes could be done. Of course, the performance of the system was not as good as after launch, but it could be impressively demonstrated, how flexible both satellite configurations and ground operations could be adapted to encounter problems.

6.5.4.2 Strange Wheel Behavior

This example illustrates how environmental effects might influence the attitude control. This situation occurred during the positioning of a geostationary communication satellite. At the last day of the LEOP, all daily activities had been performed, which included the last apogee motor firing, the solar array full deployment, the deployment of both antenna dishes, and the run-up of the fly-wheel a reaction wheels. The satellite was in a nominal configuration in the afternoon on that day. The angular momentum, stored in the fly-wheel, was nominally at around 50 Nms, but through the upcoming night, it developed unexpectedly, as shown in Fig. 6.48. The angular momentum and the speed of the fly-wheel were steadily increasing. Analysis of the AOCS and other subsystems did not lead to clear explanations. The effect was indicating that the attitude control was working against a weak, but consistent disturbance torque about the spacecraft pitch axis (north–south axis). Fuel leakages, which might cause such an effect, could not be identified.

The satellite had a corresponding FDIR mechanism, which would have reacted on this by performing an autonomous wheel unload maneuver, but in order not to interfere the next day’s flight operations activities, it was decided to perform a manual wheel unload procedure. During the night, the operations team performed it and the wheel speed was set back to a nominal value. Thus, the accumulated momentum could be removed, but the root cause was not yet understood.

The explanation was provided by the satellite’s manufacturer on the next morning. The satellite was equipped with two big payload dishes about the same size, but made of different material. One dish was made metal, but the other one consisted of composite, which tended to soak water from the air humidity at the launch site. After the deployment of the dishes, the sun was shining into them for the first time since launch and heated them up correspondingly. As a consequence, the water was evaporating from the dishes, a so-called outgassing (see Chap. 1). This created a weak but constant pressure on the dish. The disturbance torque was compensated by increasing the fly-wheel speed. So, there was no leakage and no AOCS failure, everything went fine. The effect was a natural one and disappeared after 2 days.

6.5.4.3 Undocumented AOCS Feature

BIRD was a new approach in the design of a small satellite mission dedicated to hot spot detection (forest fires, volcanic activities, burning oil wells, or coal seams), and evaluation. Payload and satellite were designed, built, and operated by DLR. The subsystem components for BIRD were chosen with respect to a low-cost mission for a planned lifetime of 1 year. The Attitude Control Subsystem ACS consisted of sun sensors, gyroscopes, magnetometer, star sensors, magnetic torquer, and reaction wheels. BIRD had only sun-pointing modes, which could be biased to realize a nadir orientation during the data takes.

The mission started in 2001 and could be operated successfully for 2 years, where pictures of the earth in different wave lengths could be gathered. One of the first shots is shown in Fig. 6.49 (left picture). In 2003, the gyro package failed and in the following hours, three of four reaction wheels were destroyed by overstraining, before the ground team had a chance to react. The contact with BIRD was lost for 5 days. It looked like the mission was over, but on day 6, telemetry could be received again. First checks of the ACS showed BIRD in a stabile orientation, spinning with around the sun direction with 4°/s and an offset angle of 40°.

A first test of a payload camera after this incident is shown in Fig. 6.49 (right picture).

This strange mode remained stable over weeks, but it was never designed so. Nevertheless, it gave the ground team enough time to update the ACS software and to proceed with degraded BIRD operations.

6.5.5 Summary

The AOCS is one of the most complex subsystems of a spacecraft. Therefore, the ground operations team and the AOCS engineers have to perform various tasks, ranging from simple subsystem monitoring to intense maneuver preparations and executions.

It is expected that future spacecraft will have more autonomy. More and more, higher control functions, like orbit maneuver planning tasks, can be implemented in the on-board control logic, e.g., the Autonomous Formation Control TAFF on board of the satellites TerraSAR-X and TanDEM-X. Another subject is the use of artificial intelligence AI methods. Precursor missions (e.g., NASA’s Deep Space 1) have already been flown.

6.6 Repeater Operations

Jürgen Letschnik

LSE Space GmbH, 82234, Wessling, Germany
Jürgen Letschnik

The Sputnik 1 is well known as the first satellite, launched on October 4, 1957. It was equipped with an on-board radio-transmitter that worked on two frequencies: 20,005 and 40,002 MHz. The first satellite which could be used for communication activities was the project SCORE in 1958 of the Americas. This satellite was equipped with a tape recorder to store and forward voice messages and it was used to send a Christmas greeting to the world from U.S. President Dwight D. Eisenhower. After that mission, NASA launched the satellite Echo 1 in 1960. The satellite consisted only of a 30.5 m diameter metalized polyethylene film balloon with a thickness of 12.7 μm. It was used to redirect transcontinental and intercontinental communication like telephone, radio, and television (Wikipedia http://en.wikipedia.org/wiki/Sputnik_1 2014).

Telstar 1 was launched in July 1962 into an elliptical orbit. It was the first active, direct relay communications satellite and the era of a telecommunication got its kickoff. Telstar successfully relayed television pictures, telephone calls, and fax images through space and provided the first live transatlantic television feed (Wikipedia http://en.wikipedia.org/wiki/Telstar 2014).

Syncom 1, launched on February 14, 1963 with the Delta B #16, was the first satellite in a geosynchronous orbit. Seconds after the apogee kick motor for circularizing the orbit was fired, the spacecraft fell silent which led to an electronics failure and therefore the satellite was lost. By using telescopic observation measurements, it could be verified that the satellite was in an orbit with a period of almost 24 h at a 33° inclination (Wikipedia http://en.wikipedia.org/wiki/Syncom 2014).

Then on July 26, 1963, the successor Syncom 2 became the first successful geosynchronous communication satellite. During the first year of Syncom 2 operations, NASA conducted voice, teletype, and facsimile tests, as well as 110 public demonstrations to show the capabilities of this satellite and invite feedback. In August 1963, President John F. Kennedy in Washington, DC, telephoned Nigerian Prime Minister Abubakar Balewa aboard USNS Kingsport docked in Lagos Harbor: the first live two-way call between heads of state by satellite. The Kingsport acted as a control station and uplink station (Wikipedia http://en.wikipedia.org/wiki/Syncom 2014).

6.6.1 Repeater Subsystem

This chapter is devoted to a description of the satellite communication payload (repeater) with the emphasis on design principles, characteristic parameters, and the technologies used for the equipment.

On most commercial communication satellites the payload consists of two distinct parts with well-defined interfaces—the repeaters and the antennas (Berlin 2005; Bostian-Allnutt 2003).

The repeater usually encompasses several channels (also called transponders) which are individually dedicated to sub-bands within the overall payload frequency band. The generic functionality and characteristic parameters of a repeater payload are presented in the following.

6.6.1.1 Functions of a Repeater Payload

The main functions of the communications repeater payload can be split up in four major functionalities; see Fig. 6.50. A detailed description of each functionality will be given in the upcoming paragraphs.

Receive

The repeater will get a signal which is received from the antenna in a given frequency band and with a given polarization, from one or more earth stations. The stations are situated within a given region (service zone) on earth and are seen from the satellite within an angle that determines the necessary angular width of the satellite antenna beam. The intersection of the satellite antenna beam with the surface of the earth defines the receive coverage.

Amplify

The signal strength received from the earth station via the antenna system of the satellite is extremely low, around −190 dBW (equalling 10⁻¹⁹ W). A direct reflection of the received signal like it was done on ECHO 1 would lead to a total loss of the whole signal. It is therefore mandatory to amplify the signal on board of the spacecraft to get a useable signal at the receiving ground terminal. To maximize the level of amplification without generating any distortion is therefore the aspired goal.

During the amplification process, the frequency from the received signal will also be converted to a different frequency to prevent disturbances between the up- and the downlink signal. At the moment, a typical and commonly used frequency range is the Ku-Band, using the 14 GHz band for uplink and the 11–12 GHz band for downlink signals (Handbook on Satellite Communications 2002; Maral and Bousquet 2002).

Route

Modern satellite systems are able to route signals between a variety of receive and transmit antenna systems on the satellite. The routing can take place on radio frequency (RF) level or on the base band level of the signal (with or without the carrier frequency as described in Sects. 1.3.2 and 1.3.3).

If the received signals are demodulated to base band level on the satellite, the repeaters are called regenerative repeaters. Based on the on-board routing configuration the data streams can be routed to different spot beams. For transmitting the signal, the stream will be modulated on an RF carrier again. Such systems are already available, for example, on EUTELSAT 13A (HB6), EUTELSAT 7A (W3A), and on several other satellites.

If the received RF signal is routed without any demodulation or modulation process, the repeater is called transparent repeater.

Transmit

The amplified and possibly also regenerated signal will now be transmitted via a transmit antenna system. Such antenna systems can be realized as single beam or multi-beam antennas depending on the application scenarios of the satellite.

6.6.1.2 Overview and Layout of a Repeater/Transponder

One of the simplest transponder configurations (without a routing functionality) of a dual polarization transponder [HLP—Horizontal Linear Polarization (X), VLP—Vertical Linear Polarization (Y)] can be seen in Fig. 6.51 and refers to the addressed functions above. The key equipment of this simple transponder will be described in this paragraph.

1.
Receive Antenna The typical realization of a spacecraft antenna is the parabolic dish especially for higher frequencies (e.g., X-Band, Ku-Band to Ka-Band). For lower frequencies like P-Band (400 MHz) Helix antennas will be used. Sizes of such antennas are in the range from around 1 m up to 8 m, e.g., EUTELSAT 10A (W2A) is using an 8 m deployable antenna in S-Band).

The antenna system can be realized as fix-mounted antennas or as steerable antennas or as a combination of both, depending on the services of the satellite provider. The usage of multi-feed antennas is becoming more and more popular; their high flux density and the possibility of frequency reuse are the driving arguments.
2.
OMT The OMT (Orthomode Transducer) is an important element of a satellite transponder system. The OMT is a wave-guide element used to split up the received polarizations HLP and VLP into two separate paths. The usage of different polarizations on the same frequency allows an increase of transmitted information capacity. A detailed description will be given in paragraph 8.
3.
LNA LNA stands for Low Noise Amplifier. As the name implies, this device is characterized by having a very low noise level while providing a high-gain level. In all cases, even with high-gain antennas, an LNA is necessary to get a good signal-to-noise ratio of the received signal.

The LNA is a broadband RF equipment and therefore able to amplify the whole receive spectrum of a dedicated frequency band (e.g., 27.5–30.0 GHz, Uplink Ka-Band). In a typical communications satellite system it is followed in the signal path by an input multiplexer that separates the channels.
4.
Downconverter The frequency of the received signal will be reduced to an intermediate frequency (IF) in order to reduce the losses and to make components simpler in the components following in the signal chain. On the ESA satellite ARTEMIS for example the IF is 5 GHz.
5.
Channel Amplifier The channel signal will then again be amplified with an adjustable channel amplifier (CAMP). Depending on the detailed design of the satellite it is possible to adjust the gain of each amplifier individually. The performance of the overall link (ground–satellite–ground) is controlled with this setting. Some satellites also have a so-called ALC amplifier (ALC—Automatic Level Control). This module adjusts the gain of the channel amplifier as a function of the signal input level coming from the antenna.
6.
Upconverter The IF that was used for amplification and routing will then be transformed to the higher frequency of the downlink. That frequency is coordinated with the ITU in the design phase to the satellite. Typically the D/L frequency band is on a lower frequency than the U/L frequency band. Filters located after the converter modules eliminate frequencies that are generated by the mixing process itself.
7.
High-Power Amplifier The high-power amplifier (HPA) plays an important role on a communication satellite system. To get an adequate signal level on ground it is necessary to generate a high RF (radio frequency) power level at the output of the satellite. Generating a signal with a high RF output level leads to a high electrical power consumption which has to be provided by the satellite platform. Traveling wave tube amplifiers (TWTA) are the most common used amplifiers on communication satellites. An efficiency of about 60 % can be expected and the higher bandwidth compared to solid-state power amplifiers (SSPA), efficiency of 10–20 %, is a positive effect. The disadvantage of a TWTA can be seen in its nonlinearity transfer curve, which plays a role later on in the operations aspect.
8.
Transmit Antenna The high-power RF signal will now be guided to the transmit antenna. Hereby the polarizations are swapped in comparison to the receive antenna system to maximize the decoupling of up- and downlink signal. Therefore the received X-polarization becomes the Y-polarization in the downlink, and vice versa the Y-polarization in the uplink becomes an X-polarization in the downlink. Figure 6.52 shows an illustrated example of the principle.
Fig. 6.52
Simplified illustration of a U/L and D/L channel allocation on a repeater subsystem for a communication satellite
Full size image

6.6.2 Repeater Operations

The general environment to operate the repeaters of a geostationary communication satellite is very similar to other space missions. Infrastructure elements like ground station, spacecraft control center, and the data network between both are necessary. The main difference is the necessity of a ground station with equipment to measure the in-orbit performance of the repeater payload. Such a ground station is called IOT station. It is equipped with special RF (radio frequency) components, like power sensors, inject-pilot systems, and an ASSC (automatic satellite saturation control) unit, to guarantee high precision measurements of the repeater subsystem.

Repeater operations in general can be split as shown in Fig. 6.53 in communications operations and spacecraft operations subdivided in mission phases of LEOP, IOT, and routine and contingency operations.

Communication Operations

The most well-known form of satellite communication is the direct-to-home broadcast of television programs via satellite. Here, the payload of the satellite (repeater) is used to spread television programs over a larger area. The satellite is only one element in the overall communication path. The care for the spacecraft activities is not in the remit of the user, because the connection time is often rented only. Typical users e.g. Play out Centers of TV stations or Satellite News Gathering (SNG) stations are coordinated and instructed by the Communication Service Center (CSC) of the satellite provider e.g. SES ASTRA, EUTELSAT, INTELSAT in configuring the uplink channels to the satellite. The user itself has no access to the repeater configuration on board.

Spacecraft Operations

The housekeeping management of communications satellites as described here is sometimes done by a separate team. The main task is to guarantee a continuous monitoring of all important parameters (housekeeping data) of the satellite which are required for proper operating of the repeater subsystem. Typical satellite parameters to be monitored will be discussed in detail in the following chapters.

6.6.2.1 LEOP Operations

During the LEOP operations of a communication satellite, the main operations focus is on getting the satellite on station and on operating the platform subsystems. Only few tasks are forseen for payload operations during that period. A typical repeater operations task is the deployment of the antenna systems. Mostly the antennas have to be in a so-called “stow position” during the launch. In many cases they are folded down because of the limited space in the shroud of the launch vehicle and to protect the antenna structure against damage due to vibrations during the launch.

Before and during the antenna deployment, engineers have to carefully monitor the temperatures of the hold-down mechanism pyros, motor currents of the antenna mechanism, the temperatures of the RF cables, and other parameters defined by the satellite manufacturer.

6.6.2.2 IOT Operations

Besides the IOT of the satellite platform, the payload IOT phase can be seen as a single phase in itself, because of its duration and complexity. The repeater subsystem is the main focus in this time. From the customer perspective, the communications payload is the most important satellite equipment. Money shall be earned by providing a guaranteed, defined service to end users.

The focus and the sensibility to perform a correct and precise IOT of the repeater subsystem is very high on the customer and satellite manufacturer side. To manage a payload IOT campaign, all platform operations activities on the satellite have to be coordinated with the RF measurement campaign, e.g., no orbital maneuvers shall take place in that time. Typically two groups of engineers are involved in this process: On the one hand the IOT ground station test engineers, mostly situated at the ground station facility, and on the other hand the spacecraft operations engineers located at the spacecraft control center (SCC). The baseline for both groups is the IOT test plan for the repeater subsystem. This plan includes a schedule of all activities which will be done during the test campaign. All satellite configurations and required changes are part of this plan. The main exercise for the SCC group is to translate these configuration requirements into operational flight procedures. Depending on the complexity of the repeater subsystem, the IOT typically takes approximately 2–3 weeks.

6.6.2.3 Routine Operations

Routine Operations of the repeater subsystem are driven by the needs of the customers who are using the repeaters for their data transmissions, an activity with low working load on the payload subsystem engineers and operators. Their main activities in this phase are monitoring and observation. Figure 6.54 shows a typical telemetry plot (tube temperature of a TWTA) from a commercial repeater payload over a period of one month, which should be monitored continuously.

In nominal and routine operations the repeater itself does not need elaborate analysis of the telemetry. Typical activities in routine operations on the repeater subsystem are:

Configuring the on-board routing between different channels and different antenna spot beams
Change the pointing of the antenna reflectors
Adjust the gain step settings of the channel amplifier
Change the conversion frequency of the on-board up-/down converters
Operations with strict observance of “Repeater Flight Rules”

On-board Routing

The functionality to route received channels to different transmit channels is one of the most interesting activities on a telecommunication satellite. One technical example of a routing base system would be the SKYPLEX technology developed by ESA and EUTELSAT. This system allows to split and recombine DVB channels transmitted from different ground stations to one signal DVB stream on board of the satellite.

Antenna Pointing

Some satellites are equipped with steerable antenna systems. With this antenna system it is possible to readjust the pointing of the generated spot beam on earth. This functionality increases the flexibility in providing communication link services, especially point-to-point connectivity services.

The adjustment of a mechanical system in space is always attended by a higher risk compared to electrically based adjustments. The manufacturer of the antenna pointing mechanism and the electronics typically defines a number of parameters which have to be within the nominal range, e.g., temperature of motors and the mechanism, to be ready for the adjustments. If heaters have to be switched ON to reach this nominal range, it could take a quite long time to reach the necessary values. This leads to a pre-adjustment period that has to be taken into account in the planning.

Gain Step Adjustment

Channel amplifiers as described in the first chapter are normally equipped with the functionality of gain adjustment. This helps to optimize the communication link for one or more customers. Each channel amplifier can be adjusted separately, which leads to a high number of gain step values which have to be monitored by the SCC. In addition to the gain steps of the channel amplifiers, the HPAs can also be equipped with a gain step adjustment functionality, which results in a lot of additional parameters to be monitored.

Modern amplifier modules are very resistant again cosmic radiation; nevertheless it can happen that a gain steps setting “flips” in its value, which has a direct and important impact on the communication link, and therefore needs the immediate attention of the engineers in the SCC, especially for the re-establishment of the correct gain step value.

Conversion Frequency

Some satellites open the possibility to change the conversion frequency of the up- and down converter. The important thing when changing this frequency is to be aware of the fact that all frequencies are coordinated for each geostationary communication satellite via the ITU. A misadjustment of the frequency can lead to interferences and disturbances on frequency bands that are used by other users.

Repeater Flight Rules

Flight Rules are generalized regulations and recommendations on how to operate the satellite. This is in contrast to the flight procedures that are very specific. An overview of typical repeater flight rules is shown in Table 6.8.

Table 6.8 Overview of typical flight rules including the recommended operational activities for a repeater subsystem

Full size table

6.6.2.4 Contingency Operations

In general, contingency operations are done hand in hand with the satellite or payload manufacturer. Other very important stakeholders are the end users of the repeater service who are transmitting their signals via the satellite. It is highly recommended to involve that group in contingency operations on the repeater subsystem.

Typically all these communication business services are managed, as discussed above in “Communication Operations,” by those special departments, “Communication Management Center” (CMC) or “CSC.”

A lot of contingency cases have already been investigated by the manufacturer before the launch. Therefore flight procedures to quickly recover the system are provided. While the execution of the recovery might only take a few hours, nevertheless the whole process, starting from error detection and analysis, can take several days.

An example of a typical redundancy switching of an HPA module (TWTA) is described in the following. Based on a drop of the anode voltage (see Fig. 6.55), the administrative and technical process with all stakeholders is triggered. Investigations and analysis lead to the decision to execute the switch-over to the redundant backup high-power amplifier module. In Fig. 6.56 both configurations before and after the backup reconfiguration are illustrated. For this reconfiguration the following equipments have to be commanded:

Power OFF of nominal high-power amplifier module (MPM 1)
Input coax switch 2 (IC Sw 2) from Position 2 to Position 3
Output wave-guide switch (OWg SW 2) Position 1 to Position 4
Power ON of redundant high-power amplifier module (MPM 3)
Readjustment of the gain steps of the HPA module

All activities have to be performed with respect to the flight rules and are based on the flight procedures which have been delivered by the manufacturer. They have to be coordinated with CSC or CMC to take care of involved communication services. This switch-over leads on the one hand to a total drop of all communication carriers of this faulty amplifier, but reestablishes on the other hand the required QOS.

Notes

1.
In general, a spacecraft bus consists of a Command and Data Handling System, a Communications system and the appropriate antennas, an Electrical Power System, a Propulsion System, Thermal Control, an Attitude and Orbit Control System, a Guidance, Navigation and Control System, as well as a structure and trusses that holds everything together. A subset is the power bus mentioned here which connects the solar panels and battery with a unit called the Power Control and Distribution Unit (PCDU).
2.
Destruction of the semiconducting material but also degradation of the covering glass.
3.
Oxidation (loss of electrons) and reduction (gaining of electrons) in each half cell (one electrode and its surrounding electrolyte).
4.
Although in colloquial terms a battery can also refer to a single cell like the ones you can buy in the supermarket. Even those often consist of more than one cell.
5.
For example from a 100 Ah (ampere hours) battery a current of 1 A could be drawn for 100 h, or a current of 100 A for 1 h (or combinations thereof).
6.
First used in 1977 on the NTS-2 satellite.
7.
Energy efficiency defines how well the stored chemical energy is converted into electrical energy.
8.
Hydrocarbons are also used as fuel, but the main differentiator is the type of electrolyte used. These range from solutions to polymers and ceramic oxides.
9.
The Juno mission to Jupiter launched on August 5, 2011, is a notable exception. The spacecraft is powered by large solar arrays.
10.
NASA is working on a combination of radioisotopes as heat source and a Stirling engine for the energy conversion called a Stirling Radioisotope Generator (SRG). Such a system promises a fourfold increase in efficiency to about 30 %.
11.
Since the radiated heat needs to be equal to the generated heat large radiators can be seen where a lot of power is generated, i.e., on space stations or designs for nuclear spacecraft such as the canceled JIMO mission.
12.
“1000” since the resistance at 0 °C is 1,000 Ω.
13.
The index of utilization of the battery is the Depth of Discharge (DoD). This is the amount of charge drained from the battery expressed as a percentage of its rated capacity.
14.
A satellite bus or spacecraft bus is the general model on which multiple-production satellite spacecraft are often based. The bus is the infrastructure of a spacecraft, usually providing locations for the payload (typically space experiments or instruments).
15.
Since cos (30°) = 0.86.
16.
Example: BOL Capacity = 20 Ah, degradation = 5 %, so the battery can only be charged up to 95 % = 19 Ah. So, one could set the maximum capacity level to 95 % to avoid overcharge and therefore thermal effects. It should be noted that for Nickel–Hydrogen batteries, a slight overcharge is actually desired.
17.
For low-earth orbit satellites with polar orbit.
18.
g ₀=9.80665 m/s².
19.
Also named after Konstantin Tsiolkovsky, a Russian scientist who derived this relation at the end of the nineteenth century.
20.
For example the state equation of an ideal gas reads PV = nRT, where P denotes the gas pressure [Pa], V its volume [m³], n its number of moles [mol], and T its temperature [K]. R = 8.314 J mol⁻¹ K⁻¹ is the ideal gas constant.

References

References to Sect. 6.1

Bryant, S., Berner, J., Operations Comparison of Deeps Space Ranging Types: Sequential Tone vs. Pseudo-Noise, 2002 I.E. Aerospace Conference, 2002.
Google Scholar
Bullock, S., Transceiver System Design for Digital Communications, Noble Publishing 1995, 1-884932-46-0
Google Scholar
ECSS 50-04C Space Data Links - Telecommand Protocols Synchronization and Channel Coding, July 2008.
Google Scholar
Reynolds, M.K., Reinhart, M.J., Bokulic, R.S., Bryant, S.: A Two-Way Noncoherent Ranging Technique for Deep Space Missions, 2002 I.E. Aerospace Conference, 2002.
Google Scholar

References to Sect. 6.2

Bussinger, S.D. et al., Spacecraft Erasable Disk Mass Memory (EDMM), 7th Annual AIAA/USU Conference on Small Satellites 1993
Google Scholar
CCSDS 132.0-B-1, TM Space Data Link Protocol.
Google Scholar
CCSDS 133.0-B-1, Space Packet Protocol
Google Scholar
ECSS 70-41A Telemetry and Telecommand Packet Utilization Standard, 2003 ECSS
Google Scholar
Evans, TM, D. and Moschini, U., “Ten Times More Information in your Real-time”, Chapter 14 in Space Operations: Experience, Mission Systems and Advanced Concepts, Schmidhuber, Cruzen, Kehr (editors), AIAA 2013, ISBN 978-1-62410-207-3
Google Scholar
“MA28140 Packet Telecommand Decoder”; Dynex Semiconductor; Publication No. DS3839-6 Issue No. 6.1 June 2000
Google Scholar
sana - Space Assigned Number Authority – [cited 28.02.2014]. Available from http://sanaregistry.org/

References to Sect. 6.3

Deng, X. and Schiff, E. A., Amorphous Silicon-based Solar Cells. In: Antonio Luque and Steven Hegedus, editors, Handbook of Photovoltaic Science and Engineering. Wiley, 2002
Google Scholar
Spacecraft Battery Technology, Robert A. Nelson, Via Satellite, 1999
Google Scholar
Laidler, K. J., Chemical Kinetics, Third Edition, Harper & Row, 1987, p.42
Google Scholar
Tapley, B. D., Bettadpur, S., Watkins, M., Reigber, C., The gravity recovery and climate experiment: Mission overview and early results, Geophys. Res. Lett., Vol. 31, No. 9, 2004
Google Scholar

References to Sect. 6.4

Fortescue, P., Swinerd, G., Stark, J. “Spacecraft Systems Engineering” Fourth Edition, Wiley, 2011.
Google Scholar

References to Sect. 6.6

Berlin, P.: Satellite Plattform Design, 5th Edition, Department of Space Science, University of Luleà and Umeà, Kiruna Schweden, ISBN 91-631-4917-6, January 2005
Google Scholar
Bostian-Allnutt, P.: Satellite Communications, ISBN 0-471-37007, Wiley, 2003
Google Scholar
Handbook on Satellite Communications, 3nd Edition, ISBN 0-471-22189-9, Wiley 2002
Google Scholar
Maral, G., Bousquet, M.: Satellite Communications Systems, 4th Edition, 2002 Wiley, ISBN 0-471-49654-5, April 2002
Google Scholar
Wikipedia “Sputnik 1” – [cited 21.02.2014]. Available from http://en.wikipedia.org/wiki/Sputnik_1
Wikipedia “Syncom” – [cited 21.02.2014]. Available from http://en.wikipedia.org/wiki/Syncom
Wikipedia “Telstar” – [cited 21.02.2014]. Available from http://en.wikipedia.org/wiki/Telstar

Download references

Author information

Authors and Affiliations

German Aerospace Center (DLR), German Space Operations Center (GSOC), Oberpfaffenhofen, 82234, Wessling, Germany
Michael Schmidhuber, Sebastian Löw, Kay Müller, Sina Scholz, Franck Chatel & Ralf Faller
LSE Space GmbH, 82234, Wessling, Germany
Jürgen Letschnik

Authors

Michael Schmidhuber
View author publications
You can also search for this author in PubMed Google Scholar
Sebastian Löw
View author publications
You can also search for this author in PubMed Google Scholar
Kay Müller
View author publications
You can also search for this author in PubMed Google Scholar
Sina Scholz
View author publications
You can also search for this author in PubMed Google Scholar
Franck Chatel
View author publications
You can also search for this author in PubMed Google Scholar
Ralf Faller
View author publications
You can also search for this author in PubMed Google Scholar
Jürgen Letschnik
View author publications
You can also search for this author in PubMed Google Scholar

Corresponding authors

Correspondence to Michael Schmidhuber , Michael Schmidhuber , Sebastian Löw , Franck Chatel , Ralf Faller or Jürgen Letschnik .

Editor information

Editors and Affiliations

Columbus Control Center, German Aerospace Center DLR, Wessling, Germany
Thomas Uhlig
German Aerospace Center DLR, Wessling, Germany
Florian Sellmaier
German Aerospace Center DLR, Wessling, Germany
Michael Schmidhuber

Rights and permissions

Reprints and permissions

Copyright information

About this chapter

Cite this chapter

Schmidhuber, M. et al. (2015). Spacecraft Subsystem Operations. In: Uhlig, T., Sellmaier, F., Schmidhuber, M. (eds) Spacecraft Operations. Springer, Vienna. https://doi.org/10.1007/978-3-7091-1803-0_6

Download citation

DOI: https://doi.org/10.1007/978-3-7091-1803-0_6
Published: 23 June 2014
Publisher Name: Springer, Vienna
Print ISBN: 978-3-7091-1802-3
Online ISBN: 978-3-7091-1803-0
eBook Packages: EngineeringEngineering (R0)

Publish with us

Policies and ethics

Spacecraft Subsystem Operations

Abstract

Similar content being viewed by others

Innovations in the AOCS of AstroSat spacecraft

Attitude and Orbit Control Systems

Attitude and Orbit Control Subsystem Operations

Keywords

6.1 Telemetry, Commanding and Ranging Subsystem

6.1.1 Definition of Subsystem

6.1.2 Signal Characteristics

6.1.2.1 Frequencies

6.1.2.2 Polarization

6.1.2.3 Side Bands and Side Lobes

6.1.3 Design

6.1.3.1 Subsystem Elements

6.1.3.2 Spacecraft Antenna Layout

6.1.3.3 Redundancies

6.1.4 Monitoring and Commanding

6.1.4.1 Automatic Gain Control

6.1.4.2 Loop Stress

6.1.4.3 Lock Status

6.1.4.4 Polarization Prediction

6.1.5 Operational Situations

6.1.5.1 Acquisition and Loss of Signal

6.1.5.2 Ranging

6.1.5.3 Doppler and Coherency

6.1.5.4 Antenna/Transponder Selection

6.1.6 Outlook to Future Developments

6.2 On-Board Data-Handling Subsystem Operations

6.2.1 Definition of Subsystem

6.2.2 Fundamentals

6.2.2.1 Subsystem Elements

6.2.2.1.1 On-Board Computer

6.2.2.1.2 Mass Memory Unit

6.2.2.1.3 Data Bus and Data Cable Harness

6.2.2.1.4 Additional Components

6.2.2.2 Redundancy

6.2.2.3 Telemetry Parameters

6.2.2.4 Telecommands

6.2.2.5 Spacecraft Database

6.2.3 Space to Ground Data Streams

6.2.3.1 Data Transport

6.2.3.2 Frame-Based Telemetry

6.2.3.3 Packet Data Structures

6.2.3.4 Packet Utilization Standard

6.2.3.5 TMTC and Security Management

6.2.3.5.1 Flow Control Mechanisms

6.2.3.5.2 Routing Mechanisms

6.2.3.5.3 Authentication

6.2.3.5.4 Encryption

6.2.4 OBDH Management

6.2.4.1 General

6.2.4.2 Safeguard Mechanisms

6.2.4.2.1 Fault Detection, Isolation, and Recovery

6.2.4.2.2 Safeguard Memory

6.2.4.3 On-Board Software Maintenance

6.2.4.3.1 Modifying the Mission Database

6.2.4.3.2 OBC Software Maintenance

6.2.4.4 Execution Management

6.2.4.4.1 Time-Tagging

6.2.4.4.2 On-Board Control Procedures

6.2.4.5 Mass Memory Management

6.2.4.5.1 Ring Buffer

6.2.4.5.2 File System

6.2.4.5.3 Linear Storage

6.2.5 Summary and Outlook

6.3 Power and Thermal Operations

6.3.1 PTS Design Aspects

6.3.1.1 Power System

6.3.1.1.1 Energy Sources and Storage

6.3.1.1.2 Solar Panels

6.3.1.1.3 Electrochemical Cells: Batteries

6.3.1.1.4 Electrochemical Cells: Fuel Cells

6.3.1.1.5 Radioisotope Thermoelectric Generators

6.3.1.1.6 Nuclear Fission (and Fusion)

6.3.1.1.7 Power Regulation, Conversion, and Distribution

6.3.1.2 Thermal System

6.3.1.2.1 Operational Needs

6.3.2 Operations

6.3.2.1 Preparation Phase