- Email: [email protected]
An Approach for Geostationary Satellite Mode Management
Proceedings of 20th The International Federation of Congress Automatic Control Proceedings of the the 20th World World Congress Proceedings of the 20th World The International International Federation of Congress Automatic Control Control Toulouse, France,Federation July 9-14, 2017 The of Automatic Available online at www.sciencedirect.com The International Federation of Automatic Control Toulouse, Toulouse, France, France, July July 9-14, 9-14, 2017 2017 Toulouse, France, July 9-14, 2017
ScienceDirect
An An An An
IFAC PapersOnLine 50-1 (2017) 7241–7246 Approach for Geostationary Approach for Geostationary Approach for Geostationary Approach for Geostationary Mode Management Mode Management Mode Mode Management Management ∗
Satellite Satellite Satellite Satellite
Massimo Tipaldi, ∗ Marco Witzmann, ∗∗ ∗∗ ∗ ∗∗∗ ∗∗ ∗ Massimo Tipaldi, Marco Witzmann, Massimo Tipaldi, Marco Witzmann, Massimo Ferraguto, and Luigi Glielmo ∗ ∗∗∗ ∗∗ ∗ Massimo Tipaldi, Marco Witzmann, ∗∗∗ and Luigi Glielmo ∗ Massimo Ferraguto, Massimo Ferraguto, ∗∗∗ and Luigi Glielmo ∗ Massimo Ferraguto, and Luigi Glielmo ∗ ∗ Department of Engineering, University of Sannio, 82100 Benevento, ∗ Department of Engineering, University of Sannio, 82100 Benevento, of University of Italy (e-mail: mtipaldi, [email protected]) ∗ Department Department of Engineering, Engineering, University of Sannio, Sannio, 82100 82100 Benevento, Benevento, Italy (e-mail: mtipaldi, [email protected]) ∗∗ Italy (e-mail: mtipaldi, [email protected]) OHB System AG, 28359 Bremen, Germany (e-mail: ∗∗ Italy (e-mail: mtipaldi, [email protected]) ∗∗ OHB System AG, 28359 Bremen, Germany (e-mail: AG, ∗∗ OHB [email protected]) OHB [email protected]) AG, 28359 28359 Bremen, Bremen, Germany Germany (e-mail: (e-mail: ∗∗∗ [email protected]) Space Systems Finland Ltd., 02200 Espoo, Finland, (e-mail: ∗∗∗ [email protected]) ∗∗∗ Space Systems Finland Ltd., 02200 Espoo, Finland, (e-mail: Ltd., [email protected]) ∗∗∗ Space Systems Finland Space Systems Finland Ltd., 02200 02200 Espoo, Espoo, Finland, Finland, (e-mail: (e-mail: [email protected]) [email protected]) [email protected]) Abstract: In each mission phase, a satellite is characterized by a well-defined set of modes. Abstract: each phase, a satellite is characterized aa well-defined set of modes. Abstract: In mission phase, a satellite is by set of They defineIn clear mission configuration spacecraft subsystemsby have specific Abstract: Inaa each each mission phase, of a the satellite is characterized characterized byand a well-defined well-defined setoperational of modes. modes. They define clear configuration of the spacecraft subsystems and have specific operational They define a configuration of the spacecraft subsystems and have specific operational implications. Inclear this paper, we present an approach for geostationary earth observation satellite They define a clear configuration of the spacecraft subsystems and have specific operational implications. In this this paper, paper, we we present an approach approach for geostationary geostationary earth observation satellite implications. In present an for satellite mode management both the Launch and Early Orbit phaseearth and observation the full operational implications. In this during paper, we present an approach for geostationary earth observation satellite mode management during both the Launch and Early Orbit phase and the full operational mode management during both the Launch and Early Orbit phase and the full operational phase. It draws on a real space mission project currently carried out at OHB System AG. The mode management during bothmission the Launch and Early Orbit phase and theSystem full operational phase. It draws on a real space project currently carried out at OHB AG. The phase. It draws on a real space mission project currently carried out at OHB System AG. configurations of the Attitude and Orbit Control System are also analyzed, their operational phase. It drawsofonthe a real space and mission project currently carried outanalyzed, at OHB their System AG. The The configurations Attitude Orbit Control System are also operational configurations of the Attitude and Control System their meaning and the relationship withOrbit the satellite modes. are It isalso alsoanalyzed, explained howoperational on-board configurations of the Attitude and Orbit Control System are also analyzed, their operational meaning and and the relationship relationship with the the satellite satellite modes. Itmode is also also explained how on-board meaning the with is explained on-board autonomy requirements play a relevant in the modes. satelliteIt definition andhow management. meaning and the relationship with therole satellite modes. Itmode is also explained how on-board autonomy requirements play a relevant role in the satellite definition and management. autonomy requirements play a relevant role in the satellite mode definition and management. Geostationary satellites can usually be operated in a quasi real-time fashion, therefore a limited autonomy requirements play a relevant role in the satellite mode definition and management. Geostationary satellites can usually be operated in aa quasi real-time fashion, therefore a limited Geostationary satellites can usually be operated in quasi real-time fashion, therefore limited level of on-board autonomy can be sufficient. However, they can be characterized high Geostationary satellites can usually besufficient. operated in a quasi real-time fashion, therefore aaby limited level of on-board autonomy can be However, they can be characterized by high level of on-board autonomy can be sufficient. However, they can be characterized by high availability requirements and have a need for ground operation reduction, which can lead to level of on-board autonomy bea need sufficient. However, they can be characterized high availability requirements and can have for ground operation reduction, which can can by lead to availability requirements and have a need for ground operation reduction, which lead to an increased level of on-board autonomy in satellite mode management. availability requirements and have a need for ground operation reduction, which can lead to an increased level of on-board autonomy in satellite mode management. an increased level of on-board autonomy in satellite mode management. an increased level of on-board autonomy in satellite mode management. © 2017, IFAC (International Federation of Automatic Control) Hosting by Elsevier Ltd. All rights reserved. Keywords: Mission Control and Operations, Spacecraft Mode Management, Autonomous Keywords: Mission Control Control and and Operations, Operations, Spacecraft ModePhase, Management, Autonomous Keywords: Mission Spacecraft Mode Management, Autonomous Systems, Man-in-the-loop Launch and Early Orbit Geostationary Orbit, Keywords: Mission ControlSystems, and Operations, Spacecraft ModePhase, Management, Autonomous Systems, Man-in-the-loop Systems, Launch and Early Orbit Geostationary Orbit, Systems, Man-in-the-loop Systems, Launch and Early Orbit Phase, Geostationary Attitude and Orbit Control System Systems, Man-in-the-loop Systems, Launch and Early Orbit Phase, Geostationary Orbit, Orbit, Attitude and Orbit Control System Attitude Attitude and and Orbit Orbit Control Control System System 1. INTRODUCTION tonomy. Spacecraft can be endowed with a specific level 1. INTRODUCTION INTRODUCTION tonomy. Spacecraft canwhich be endowed endowed withthe specific level 1. tonomy. Spacecraft can be with aaa specific level of on-board autonomy, determines distribution 1. INTRODUCTION tonomy. Spacecraft canwhich be endowed withthe specific level of on-board autonomy, determines distribution Starting from the launch phase up to its disposal, and of on-board autonomy, determines the distribution responsibilities and which the corresponding capabilities of of on-board autonomy, which determines the distribution Starting from the launch phase up to its disposal, and of responsibilities responsibilities and thethe corresponding capabilities of Starting from the launch phase up its disposal, and in each mission phase, a satellite is to characterized by a of and the corresponding capabilities of the ground station versus spacecraft. From an operStarting from the launch phase up to its disposal, and of responsibilities and thethe corresponding capabilities of in each each mission mission phase, awhose satellite is characterized characterized by aa the the ground station versus spacecraft. From an operin phase, a satellite is by well-defined set of modes, definition and operational ground station versus the spacecraft. From an operational point of view, on-board autonomy can be actually in each mission phase, awhose satellite is characterized by a the ground station versus the spacecraft. From an operwell-defined set of modes, definition and operational ational point of view, on-board autonomy can be actually well-defined set modes, operational implication are step indefinition any spaceand mission design ational point of autonomy can be regarded as migration of functionality ground well-defined set aaof ofrelevant modes, whose whose definition and operational ational of view, view, on-board on-board autonomyfrom can the be actually actually implication are relevant step in inThis any is space mission design regarded regardedpoint asthe migration of functionality functionality from the ground implication are a relevant step any space mission design and spacecraft manufacturing. actually a system as migration of from the ground segment to flight segment, see Grant et al. (2006). In implication are amanufacturing. relevant step inThis any is space mission design regarded asthe migration of functionality from the ground and spacecraft actually a system system segment to flight segment, see Grant et al. (2006). In and spacecraft manufacturing. This is actually a engineering discipline and has to take into account the segment to the flight segment, see Grant et al. (2006). In this respect, Esteve et al. (2012) account for some keyand spacecraft manufacturing. This is actually a system segment to the flight et segment, see account Grant etfor al. some (2006). In engineering discipline and has to to take into into account the this this respect, Esteve al. (2012) (2012) keyengineering discipline and has take account the complete life-cycle of a satellite, especially its operational respect, Esteve et al. account for some keyfactors, that is to say mission type, mission objectives and engineering discipline and has to take into account the this respect, Esteve et al. (2012) account for some keycomplete life-cycle of a satellite, especially its operational factors, that is to say mission type, mission objectives and complete life-cycle of especially operational constraints and requirements. satellite its mode can be factors, that is type, mission objectives and priorities, type of say themission spacecraft orbit, spacecraft ground complete life-cycle of aa satellite, satellite,A operational factors, that is to to say type, mission objectives and constraints and requirements. Aespecially satellite its mode can be priorities, priorities, type ofoperations themission spacecraft orbit, spacecraft ground constraints and requirements. A satellite mode can be regarded as a clearly identified configuration of both sateltype of the spacecraft orbit, spacecraft ground visibility profile, concepts, and communication constraints and requirements. A satellite mode can be priorities, type of the spacecraft orbit, spacecraft ground regarded as a clearly identified configuration of both satelvisibility profile, profile, operations concepts, concepts, and communication regarded as clearly identified configuration of satellite platform payload hardware and software. operations communication constraints. Its traditional notion as and predefined explicit regarded as aa and clearly identified configuration of both both Every satel- visibility visibility profile, operations concepts, communication lite platform platform and payload hardware and software. software. Every constraints. Itsfulfill traditional notion as and predefined explicit lite and payload hardware and Every satellite mode has operational implications, meaning that constraints. Its traditional notion as predefined explicit behaviors can the needs for satellites operating in a lite platform and payload hardware and software. Every constraints. Its traditional notion as predefined explicit satellite mode has operational implications, meaning that behaviors can fulfill the needs for satellites operating in satellite mode has operational implications, meaning that each satellite mode allows a specific set of operations in behaviors can fulfill the needs for satellites operating in aa predictable environment. However, this approach is not adsatellite mode mode has operational implications, meaning that behaviors can fulfill the needs for satellites operating in a each satellite allows a specific set of operations in predictable environment. However, this approach is not adeach satellite mode allows a specific set of operations in order to fulfillmode operational and environment. However, this approach is not adequate for spacecraft operating in unpredictable contexts, each satellite allows aobjectives specific set of requirements, operations in predictable predictable environment. However, this approach is not adorder to fulfill operational objectives and requirements, equate feature for spacecraft spacecraft operating in unpredictable unpredictable contexts, order to operational objectives and see Eickhoff (2012). Initialization of a mode (at satellite, equate for operating in which deep space exploration systems orcontexts, critical order to fulfill fulfill operational objectives and requirements, requirements, equate feature for spacecraft operating in unpredictable see Eickhoff Eickhoff (2012). Initialization of includes a mode mode (at satellite, which deepsuch space exploration systems or orcontexts, critical see (2012). Initialization of a (at satellite, subsystem, instrument or unit level) the configuwhich feature deep space exploration systems critical operational phases as automated spacecraft docking. see Eickhoff (2012). Initialization of a mode (at satellite, which feature deep space exploration systems or critical subsystem, instrument or unit level) includes the configuoperational phases such as automated spacecraft docking. subsystem, or unit level) includes the configuration of theinstrument necessary hardware and software, periodic operational phases such as automated spacecraft docking. Further drivers for rich on-board autonomy are the overall subsystem, instrument or unit level) includes the configuoperational phases such as automated spacecraft docking. ration of of the the necessary necessary hardware and software, the periodic Further Further drivers drivers for rich on-boardavailability autonomy and are the the overall ration hardware and periodic transmission of telemetry packets, thesoftware, periodicthe acquisition for rich on-board autonomy are overall improvement of the spacecraft reliability, ration of the necessary hardware and software, the periodic Further drivers for rich on-boardavailability autonomy and are the overall transmission ofparameters, telemetry packets, packets, theactivation periodic acquisition acquisition improvement of the spacecraft reliability, transmission of telemetry the periodic of telemetry and the of all the improvement of the spacecraft availability and reliability, and the reduction costs in ground segment transmission ofparameters, telemetry packets, theactivation periodic acquisition improvement of theof spacecraft availability andoperations, reliability, of telemetry and the of all the and the reduction of costs in ground segment operations, of telemetry parameters, and the of all automatic processes required to achieve the mode, the reduction costs which address of long-term planningsegment insteadoperations, of day-toof telemetry parameters, and the activation activation of monitor all the the and and thecan reduction of costs in in ground ground segment automatic processes required to achieve achieve the mode, mode, monitor which can address long-term planning insteadoperations, of day-toautomatic processes required to the monitor its health status, and stay within in a stable manner. which can address long-term planning instead of day procedures, see van der Ha (2003). automatic processes to achieve the mode, monitor which can address long-term planning instead of day-today-toits health status, status, andrequired stay within within in aa stable stable manner. day procedures, see van der Ha (2003). its health and stay in manner. day see van der Ha (2003). its healthimportant status, and stayis within in a stable manner. day procedures, procedures, seeon van Ha management (2003). Another topic the definition of the autonomy This paper focuses theder mode approach for Another important topic istransitions, the definition definition of the the autonomy paper focuses focuses on the the mode management management approach for Another the of autonomy level for important spacecraft topic modeis which impacts the This paper on mode approach for aThis geostationary earth observation satellite system during Another important topic istransitions, the definition of the autonomy This paper focuses on the mode management approach for level forspacecraft spacecraft modeand which impacts the athe a geostationary geostationary earth observation satellite system during level for spacecraft mode transitions, which impacts the overall design the mission operational conearth during Launch and Early Orbit Phase satellite (LEOP)system and when the level forspacecraft spacecraft modeand transitions, which impactsconthe the a geostationary earth observation observation satellite system during overall design the mission operational Launch and Early Orbit Phase (LEOP) and when the overall spacecraft design the operational concept. Spacecraft autonomy is a matter of degree Launch Early Orbit Phase and when satellite hasand reached Geostationary Orbit It overall spacecrafton-board design and and the mission mission operational con- the the Launch and Earlythe Orbit Phase (LEOP) (LEOP) and(GEO). when the the cept.isSpacecraft Spacecraft on-board autonomy is aa matter matter of (2007). degree satellite has reached the Geostationary Orbit (GEO). It cept. on-board autonomy is of degree and continuously increasing, see Jonsson et al. satellite has reached the Geostationary Orbit (GEO). It draws on a real space mission project currently carried cept. Spacecraft on-board autonomy is a matter of (2007). degree satellite has reached themission Geostationary Orbit (GEO). It and is continuously increasing, see Jonsson et al. draws on a real space project currently carried and continuously Jonsson al. The ECSS-E-ST-70-11C (2008) see defines four et of au- draws on a real space mission project currently carried and is is continuously increasing, increasing, see Jonsson etlevels al. (2007). (2007). draws on a real space mission project currently carried The ECSS-E-ST-70-11C (2008) defines four levels of auThe The ECSS-E-ST-70-11C ECSS-E-ST-70-11C (2008) (2008) defines defines four four levels levels of of auau-
Copyright © 2017 IFAC 7512 2405-8963 © 2017, IFAC (International Federation of Automatic Control) Hosting by Elsevier Ltd. All rights reserved. Copyright © 2017 IFAC 7512 Copyright ©under 2017 responsibility IFAC 7512Control. Peer review of International Federation of Automatic Copyright © 2017 IFAC 7512 10.1016/j.ifacol.2017.08.1371
Proceedings of the 20th IFAC World Congress 7242 Massimo Tipaldi et al. / IFAC PapersOnLine 50-1 (2017) 7241–7246 Toulouse, France, July 9-14, 2017
out at OHB System AG. Such space mission will provide Europe with an operational satellite system able to support accurate prediction of meteorological phenomena and the monitoring of climate and air composition through operational applications. As a rule, geostationary satellites have continuous ground visibility with very small communication delay. If needed, they can be operated in a quasi real-time fashion, therefore a limited level of onboard autonomy can be sufficient. However, due to their mission objectives, they may have very high availability requirements, as loss of service has economical consequences. They may also have a need for reduction in ground operation intervention. These factors can imply increasing the on-board autonomy. Thus, we have two extreme cases, either the ground operators drive the complete satellite mode transition down to each reconfigurable HW or SW unit by executing a step-by-step procedure and uploading the related telecommands, or the ground operators send a telecommand to trigger a mode transition with the satellite converting it into a series of on-board operations for the spacecraft subsystem reconfiguration. Some satellite mode transition can be implemented with the former approach, others with the latter. In the solution hereafter proposed, satellite mode transitions triggered by critical on-board detected failures are autonomously managed by the Onboard Software (OBSW). As for nominal ground operations, the first approach is basically preferred with some very few exceptions. This paper also shows the link between the satellite and the Attitude and Orbit Control System (AOCS) modes during the LEOP and GEO phases. It has been organized as follows. Section 2 provides the operational meaning of the satellite, AOCS, and payload modes. Section 3 describes the approach for satellite mode transition, in particular it distinguishes between the man-in-the-loop mode transitions and the ones carried out autonomously by the spacecraft. Section 4 shows how the satellite and AOCS mode change during the LEOP phase up to the transition into the GEO orbit. Section 5 focuses on satellite and AOCS mode management during the GEO phase. Finally, section 6 concludes the paper. 2. SATELLITE MODE DEFINITIONS
•
•
•
•
The operational concept of a typical spacecraft includes one or more safe mode configurations that represent the ultimate reaction to spacecraft severe anomalies. In safe mode, the communication link to ground, a specific power supply profile, and thermal survival functions for relevant equipment are maintained, whereas all nonessential onboard units/subsystems are powered off, some subsystems/units can be switched to redundant hardware parts, and the spacecraft is (automatically) oriented to a particular attitude with respect to the Earth or the Sun, see Tipaldi and Bruenjes (2015). Safe mode has to be carefully conceived in terms of spacecraft configuration, observability, and commandability (for instance, OBSW dump and patch functions). The payload modes shall be compatible with the primary satellite modes. We can identify the following payload basic modes: • In Survival Mode, the payload is off, however the satellite platform enables the protection devices, such as the survival thermal lines. • In Stand-by mode, the payload is on and some basic monitoring and power lines are activated. • In Wait Mode, the payload is ready to operate. AOCS a-priori compensation for the scanning movement of the payload is activated, see Gimenez et al. (2005). • In Operational mode, the instrument is fully operable and provides science data.
Modes are conceived at satellite, AOCS, and payload level. The following satellite modes can be defined (see Fig. 1): • The satellite is in Launch Mode (LAM) from the moment of transfer of power provision from ground to the on-board batteries, until satellite separation from the launcher. During LAM, the satellite batteries are powered, the S-band receivers are on, one S-band transmitter is on, and the satellite communication buses are initialized. After having enabled all the analog and digital acquisition/commanding lines, the On-board Computer (OBC) waits for the separation signal to start the separation sequence. Survival thermal control functionality is also guaranteed. • At detection of launcher separation by the OBC, the satellite enters automatically the Sun Acquisition Mode (SAQ) and executes the separation sequence. Solar panels are oriented towards a specific reference position (the platform has a solar-array driving mechanism), and the Sun pointing has to be reached and
maintained. The SAQ can be also entered upon a Ground TC. In Nominal Mode (NOM), the satellite along its payload is fully operational. The satellite is threeaxes stabilized ensuring the required high pointing accuracy of +Z face (see Fig. 2) towards the Earth in order to provide mission product data and services, once configured, in a autonomous way. The Yaw Flip Mode (YFM) is required at each equinox to avoid direct Sun illumination of the satellite −Y face due to thermal reasons (the only radiator is placed on the −Y face). The satellite will rotate around the Z axis thanks to its reaction wheels. In Stand-by Mode (SBM), the satellite acts as an inorbit spare not used for any operational service but able to become operational within a short time frame. Full health and safety activities are maintained, including continuous real time monitoring. Thrusters are disabled via the latch valves system. The satellite enters the Safe Mode under critical on-board anomaly detection, which cannot be autonomously recovered or which, though recovered, could present a risk later on if normal operations are continued. Return to normal operations is completely carried out under ground control.
The management of payload modes is under direct Ground control (which means that mode transition TCs are directly routed to the payload). The spacecraft switches automatically payload modes in defined failure cases, such as during the transition into safe mode. In the same way, the AOCS modes shall be compatible with the primary satellite mode. The following AOCS modes are defined:
7513
Proceedings of the 20th IFAC World Congress Massimo Tipaldi et al. / IFAC PapersOnLine 50-1 (2017) 7241–7246 Toulouse, France, July 9-14, 2017
7243
Fig. 1. Satellite modes and corresponding transitions • The Station Keeping Mode (SKM) is entered to perform attitude control manoeuvres via the reaction wheels, orbit correction manoeuvres via the thrusters, and reaction wheel off-loading by means of the thrusters. • Fine Pointing Mode (FPM) is used for precise satellite attitude manoeuvres. It is performed via the reaction wheels and is devoted to the payload operations. Stable pointing is guaranteed, for instance the disturbance of the payload can be compensated by feedforwarding its nominal torque. • The Survival Mode (SRM) performs a stabilized and robust Sun pointing in case of critical failure, independently of ground support. Fig. 2. Satellite axis orientation in nominal mode • In STBY mode all the sensors and the actuators are available, however any closed loop actuation is not applied, therefore neither the thrusters nor the reaction wheels are commanded by the AOCS. • In Sun Acquisition Mode (SAM), the AOCS damps high angular momentum, points the −Z face towards the Sun, and spins around the Z axis. • The Guided Attitude Mode (GAM) is designed to allow any kind of pointing and to perform small attitude manoeuvres, thus increasing the flexibility of operations of the satellite. GAM is commanded with a guidance profile to be tracked, uploaded from ground. GAM is used as an intermediate mode, to achieve defined attitude states, which are needed, e.g., at the beginning of orbit transfer manoeuvres. • The Orbit Transfer Mode (OTM) gives the capability of performing the transfer to GEO using the Liquid Apogee Engine (LAE), while maintaining the attitude compatible with this orbit correction. The mode is provided with a guidance profile uploaded from ground with a format similar to the one used in GAM.
We mention the type of AOCS sensors used in our space mission to provide a better insight into its AOCS architecture: star tracker, gyroscope, coarse rate sensor, and coarse Sun sensor. Finally, satellite, payload, and AOCS modes are observable by Ground via relevant telemetry packets. 3. SATELLITE MODE TRANSITIONS In the solution illustrated in this paper, spacecraft mode transitions are normally carried out by the ground segment, which first transmits to the satellite a series of telecommands necessary to perform the corresponding subsystem/satellite unit configuration, and then the actual satellite mode transition. In European space projects, structures for all the telecommands and telemetry are based on the Packet Utilization Standard, see ECSS-E70-41A (2003). Fig. 3 outlines the relationship among Satellite, AOCS, and Payload modes in the different mission phases. Initialization of a satellite mode includes the configuration of all the necessary hardware and software, the activation of the mode-specific telemetry parameters acquisition, the activation of the mode-specific telemetry packets generation, the activation of the mode-specific
7514
Proceedings of the 20th IFAC World Congress 7244 Massimo Tipaldi et al. / IFAC PapersOnLine 50-1 (2017) 7241–7246 Toulouse, France, July 9-14, 2017
3.1 AOCS Sub-modes in Sun Acquisition Mode
Fig. 3. Satellite, AOCS and paylaod mode combination in each mission phase
The purpose of the Sun Acquisition Mode (SAM) is to acquire a stable Sun pointing attitude for all initial conditions. This is achieved by applying a control, that reduces high values of initial rotation (or initial angular momentum), slews the spacecraft such that the −Z face is pointing towards the Sun, and enables a slow spinning of the spacecraft around the Z axis. The reduction of the initial angular rates of the satellite can be achieved first by using the thrusters and then by using the reaction wheels. This is why SAM consists of three sub-modes: Thruster Detumbling (TD), Thruster Sun Acquisition (TSA), and Reaction Wheel Sun Acquisition (RWSA). The logic of sub-mode selection in SAM is shown in Fig. 4. At launch, the parameter PAR SaSubModeSet and the AOCS SAM submode are respectively set to NONE and TD. As consequence, the SAM always starts with TD. As soon as the rates are below the threshold, SAM switches from TD to either TSA or RWSA in the next AOCS cycle according to the following rule: • RWSA is selected if at least four reaction wheels are on and healthy. • TSA is selected if less than four reaction wheels are on and healthy. Since the spacecraft is launched with all the reaction wheels in off condition, the TSA sub-mode is automatically entered. On the other hand, during the GEO phase, the parameter PAR SaSubModeSet is overwritten, thus the AOCS enters the commanded submode and stays there (see the left side of the Fig. 4). RWSA provides some advantage over TSA, that is to say, reduced fuel consumption and low orbit disturbance.
Fig. 4. AOCS sub-mode transitions in SAM 3.2 Separation Sequence SW processing and/or algorithms, and the AOCS/payload mode transition. Finally, the command for the actual satellite mode transition is sent to the spacecraft. All these steps have to be carried out by the ground operators through a well-defined procedure. They have also to check the correctness of the command execution. Besides this, satellite mode transitions can be triggered autonomously by the OBSW in case of level 3 or level 4 failures (failure level definition is described in Tipaldi and Bruenjes (2015)) or in very limited nominal operations, for example, during the transition from LAM to SAQ at the beginning of the separation sequence. When level 3 or level 4 failures occur, the satellite can enter automatically either the SAQ or the safe mode (see Fig. 1). Interesting is the case that when the AOCS is in FPM mode, the first occurrence of level 3 failure is not managed by downgrading the satellite to a lower configuration. In this case, the tradeoff between safety versus mission completion has privileged the latter, see Tipaldi and Glielmo (2016). The remaining part of this chapter describes the AOCS SAM and the separation sequence in more details. This information is necessary for a better understanding of the satellite LEOP phase.
The separation sequence starts after the actual separation from the launcher. It aims at bringing the satellite into a safe and stable configuration with the solar arrays deployed and −Z face pointing to Sun without any need for ground operation during this sequence. The satellite mode is set to SAQ, whereas the AOCS mode can be either SBTY or SAM. All the AOCS manoeuvres are carried out by means of the thrusters since all the reaction wheels are off. The activities performed during the Separation Sequence are: • Venting, and then pressurization of the propulsion subsystem: the AOCS mode is set to STBY. • Spacecraft rate damping and attitude control by means of thrusters: the AOCS mode is set to SAM, the sub-mode to TD, and then to TSA once the spacecraft rate is lower that a specific threshold. • Deployment of the solar array: the AOCS mode is set to STBY The separation sequence ends after the solar array deployment with the AOCS mode set to SAM and the AOCS sub-mode set to TSA.
7515
Proceedings of the 20th IFAC World Congress Toulouse, France, July 9-14, 2017 Massimo Tipaldi et al. / IFAC PapersOnLine 50-1 (2017) 7241–7246
7245
The transition into SAQ/GAM is performed via TC by the ground operator. GAM is used as an intermediate mode, to achieve the necessary attitude states at the beginning of orbit transfer manoeuvres. This adjustment of the satellite attitude is achieved by a guidance profile, uploaded from ground. GAM is associated with a time out: when the time-out expires, AOCS performs an autonomous transition into SAM. In OTM, the LAE is used for the orbit manoeuvres, whereas the thrusters for the attitude control are used. For each LAE burn, ground operators determine and upload the change in velocity and the attitude profile. When the OTM manoeuvre is completed, ground can command the transition into SAQ/SAM to adjust the Sun pointing when needed.
5. MODE TRANSITIONS IN GEO
Fig. 5. Satellite mode management in LEOP 4. MODE TRANSITIONS IN LEOP The satellite and AOCS mode management during the LEOP phase is shown in Fig. 5. The following satellite/AOCS modes are used: • Separation sequence: SAQ/STBY (for propulsion initialization), SAQ/SAM(AOCS submode set to TD, and then TSA), and SAQ/STBY (for solar array deployment). • Preparation for the transfer to the GEO orbit: SAQ/SAM (AOCS submode set to RSWA), and SAQ/GAM. • Transfer to the GEO orbit: SAQ/OTM, SAQ/SAM, and end of LEOP. At completion of separation sequence, the spacecraft is in Sun pointing attitude with solar panels deployed and the AOCS is in SAM-TSA, the satellite mode is SAQ. Afterwards, the reaction wheels are switched on by ground through a specific flight operation procedure. This enables the automatic transition into SAM-RWSA. As a result, the complete operation is accomplished via a hybrid thrusters and reaction wheels strategy, very suitable for large angle and rapid spacecraft reorientation, see Ye et al. (2012). Thrusters can provide a larger control torque, but can not be used to achieve high control accuracy, see Sidi (2000). Another disadvantage of thrusters is their fuel consumption. Conversely, reaction wheels are capable of finer control for high precision control demand. In addition, reaction wheels consume only electrical energy. The idea of incorporating both thrusters and reaction wheels is to take advantage of the strong points of each individual type of actuators. Thrusters can be used during the whole separation sequence, afterwards ground can decide to enter the RWSA sub-mode to provide the fine control torque.
The satellite and AOCS mode management during the GEO phase is shown in Fig. 6. The satellite mode set-up and transitions are completely performed by the ground operators with the exception of level 3 or level 4 failures, which are managed by automatic transition either into SAQ or Safe mode. The first transition from SAQ into NOM is executed during commission phase after arrival on the GEO location. The following steps are executed by Ground: SAQ/SAM → SAQ/GAM → NOM/SKM → NOM/FPM. Once the momentum and the angular rate in SKM mode are below a specific threshold, a transition into FPM mode can be performed. AOCS a-priori compensation is started and the payload can be configured in order to provide the required mission product data and services. The SKM can also enter autonomously the FPM if after the time-out expiration the dynamics entry conditions on angular error and rate error are satisfied. If the dynamic conditions for FPM are not reached when the SKM timeout expires, the spacecraft remains in SKM. The abovementioned procedure is also executed from Ground after level 3 failure. Moreover the transition from SAQ mode into NOM mode also occurs as part of the recovery from Safe Mode, where the ground recovery procedure foresees a transition from Safe Mode to SAQ/SAM and then continues up to NOM mode. From NOM mode the spacecraft mode can enter the SBM mode. Ground has to command payload into WAIT mode as well as to stop any AOCS a-priori compensation. From NOM mode, ground can also initialize transition in YFM mode, provided that the payload is in WAIT mode and the AOCS a-priori compensation has been stopped. The YFM mode can also be entered from the SBM mode. In YFM mode, the AOCS remains in FPM for the rotation around Z axis. Ground determines the direction of rotations, pending on the hour of day for the manoeuvre. The transition into Safe Mode is performed automatically: as for the relevant satellite units, their redundant part is activated (for instance as for the OBC, the redundant processor module is used), whereas the not-essential units are off. Ground failure investigation in Safe Mode determines which units are healthy and available to try the re-boot into SAQ/SAM. The recovery procedure from Safe mode is completely under ground responsibility. In order to make use of RWSA sub-mode for fuel saving reason, ground
7516
Proceedings of the 20th IFAC World Congress 7246 Massimo Tipaldi et al. / IFAC PapersOnLine 50-1 (2017) 7241–7246 Toulouse, France, July 9-14, 2017
Fig. 6. Satellite mode management in GEO should switch on the reaction wheels whilst still in Safe Mode. 6. CONCLUSION AND FURTHER CONSIDERATIONS This paper has presented the mode definition and management for a geostationary earth observation satellite system during the Launch and Early Orbit Phase and the full operational phase. It draws on a real space mission project currently carried out at OHB System AG. A satellite mode defines a clear configuration of the spacecraft subsystems and has specific operational implications. The configurations of the Attitude and Orbit Control System are also analyzed. Autonomy requirements drive the design of the satellite modes. In this respect, it has been shown that geostationary satellites do not need a high level of onboard autonomy for satellite mode management. In the proposed solution, satellite mode transitions—triggered by critical on-board detected failures or during the separation sequence—are autonomously managed by the satellite to fulfill availability requirements. As for the nominal mode transitions, the ground operators drive the complete process down to each reconfigurable HW or SW unit by executing a step-by-step procedure and uploading the related telecommands. The authors regard this solution not suitable for deep space exploration missions, where a higher level of autonomy is needed. In such cases, only satellite mode transitions could be commanded by ground. Then, the spacecraft could configure autonomously all its subsystems according to the commanded spacecraft mode. The On-Board SW can drive the mode transition by executing and monitoring the reconfiguration actions of all the subsystems needed to enter the desired mode. A further evolution could be the complete autonomous spacecraft mode management during critical mission phases. All that can lead to a relevant reduction in ground operation costs.
Cooperation for Space Standardization. ECSS-E-ST-70-11C (2008). Space engineering - space segment operability. European Cooperation for Space Standardization. Eickhoff, J. (2012). Onboard computers, cnboard software and satellite operations: an introduction. Springer. Esteve, M., Katoen, J., Nguyen, V., Postma, B., and Yushtein, Y. (2012). Formal correctness, safety, dependability, and performance analysis of a satellite. In International Conference on Software Engineering (ICSE), 1022–1031. Gimenez, A., Langevin, Y., Barcons, X., Harrison, R., Appourchaux, T., Perryman, M., Balogh, A., and Coradini, A. (2005). Payload and mission definition in space sciences. Cambridge University Press. Grant, T., Soler, A., Bos, A., Brauer, U., Neerinex, M., and Wolff, M. (2006). Space autonomy as migration of functionality: the mars case. In Proceedings of Space Mission Challenges for Information Technology, 201– 208. Jonsson, A., Morris, R., and Pedersen, L. (2007). Autonomy in space current capabilities and future challenges. AI Magazine, 8, 27–42. Sidi, M.J. (2000). Spacecraft dynamics and control: a practical engineering approach. Cambridge University Press. Tipaldi, M. and Bruenjes, B. (2015). Survey on fault detection, isolation, and recovery strategies in the space domain. Journal of Aerospace Information Systems, 12, 235–256. Tipaldi, M. and Glielmo, L. (2016). State aggregation approximate dynamic programming for model-based spacecraft autonomy. In European Control Conference (ECC), 86–91. van der Ha, J. (2003). Trends in cost-effective mission operations. Acta Astronautica, 52, 337–342. Ye, D., Sun, Z., and Wu, S. (2012). Hybrid thrusters and reaction wheels strategy for large angle rapid reorientation with high precision. Acta Astronautica, 77, 149–155.
REFERENCES ECSS-E-70-41A (2003). Ground systems and operations telemetry and telecommand packet utilization. European 7517
ScienceDirect
An An An An
IFAC PapersOnLine 50-1 (2017) 7241–7246 Approach for Geostationary Approach for Geostationary Approach for Geostationary Approach for Geostationary Mode Management Mode Management Mode Mode Management Management ∗
Satellite Satellite Satellite Satellite
Massimo Tipaldi, ∗ Marco Witzmann, ∗∗ ∗∗ ∗ ∗∗∗ ∗∗ ∗ Massimo Tipaldi, Marco Witzmann, Massimo Tipaldi, Marco Witzmann, Massimo Ferraguto, and Luigi Glielmo ∗ ∗∗∗ ∗∗ ∗ Massimo Tipaldi, Marco Witzmann, ∗∗∗ and Luigi Glielmo ∗ Massimo Ferraguto, Massimo Ferraguto, ∗∗∗ and Luigi Glielmo ∗ Massimo Ferraguto, and Luigi Glielmo ∗ ∗ Department of Engineering, University of Sannio, 82100 Benevento, ∗ Department of Engineering, University of Sannio, 82100 Benevento, of University of Italy (e-mail: mtipaldi, [email protected]) ∗ Department Department of Engineering, Engineering, University of Sannio, Sannio, 82100 82100 Benevento, Benevento, Italy (e-mail: mtipaldi, [email protected]) ∗∗ Italy (e-mail: mtipaldi, [email protected]) OHB System AG, 28359 Bremen, Germany (e-mail: ∗∗ Italy (e-mail: mtipaldi, [email protected]) ∗∗ OHB System AG, 28359 Bremen, Germany (e-mail: AG, ∗∗ OHB [email protected]) OHB [email protected]) AG, 28359 28359 Bremen, Bremen, Germany Germany (e-mail: (e-mail: ∗∗∗ [email protected]) Space Systems Finland Ltd., 02200 Espoo, Finland, (e-mail: ∗∗∗ [email protected]) ∗∗∗ Space Systems Finland Ltd., 02200 Espoo, Finland, (e-mail: Ltd., [email protected]) ∗∗∗ Space Systems Finland Space Systems Finland Ltd., 02200 02200 Espoo, Espoo, Finland, Finland, (e-mail: (e-mail: [email protected]) [email protected]) [email protected]) Abstract: In each mission phase, a satellite is characterized by a well-defined set of modes. Abstract: each phase, a satellite is characterized aa well-defined set of modes. Abstract: In mission phase, a satellite is by set of They defineIn clear mission configuration spacecraft subsystemsby have specific Abstract: Inaa each each mission phase, of a the satellite is characterized characterized byand a well-defined well-defined setoperational of modes. modes. They define clear configuration of the spacecraft subsystems and have specific operational They define a configuration of the spacecraft subsystems and have specific operational implications. Inclear this paper, we present an approach for geostationary earth observation satellite They define a clear configuration of the spacecraft subsystems and have specific operational implications. In this this paper, paper, we we present an approach approach for geostationary geostationary earth observation satellite implications. In present an for satellite mode management both the Launch and Early Orbit phaseearth and observation the full operational implications. In this during paper, we present an approach for geostationary earth observation satellite mode management during both the Launch and Early Orbit phase and the full operational mode management during both the Launch and Early Orbit phase and the full operational phase. It draws on a real space mission project currently carried out at OHB System AG. The mode management during bothmission the Launch and Early Orbit phase and theSystem full operational phase. It draws on a real space project currently carried out at OHB AG. The phase. It draws on a real space mission project currently carried out at OHB System AG. configurations of the Attitude and Orbit Control System are also analyzed, their operational phase. It drawsofonthe a real space and mission project currently carried outanalyzed, at OHB their System AG. The The configurations Attitude Orbit Control System are also operational configurations of the Attitude and Control System their meaning and the relationship withOrbit the satellite modes. are It isalso alsoanalyzed, explained howoperational on-board configurations of the Attitude and Orbit Control System are also analyzed, their operational meaning and and the relationship relationship with the the satellite satellite modes. Itmode is also also explained how on-board meaning the with is explained on-board autonomy requirements play a relevant in the modes. satelliteIt definition andhow management. meaning and the relationship with therole satellite modes. Itmode is also explained how on-board autonomy requirements play a relevant role in the satellite definition and management. autonomy requirements play a relevant role in the satellite mode definition and management. Geostationary satellites can usually be operated in a quasi real-time fashion, therefore a limited autonomy requirements play a relevant role in the satellite mode definition and management. Geostationary satellites can usually be operated in aa quasi real-time fashion, therefore a limited Geostationary satellites can usually be operated in quasi real-time fashion, therefore limited level of on-board autonomy can be sufficient. However, they can be characterized high Geostationary satellites can usually besufficient. operated in a quasi real-time fashion, therefore aaby limited level of on-board autonomy can be However, they can be characterized by high level of on-board autonomy can be sufficient. However, they can be characterized by high availability requirements and have a need for ground operation reduction, which can lead to level of on-board autonomy bea need sufficient. However, they can be characterized high availability requirements and can have for ground operation reduction, which can can by lead to availability requirements and have a need for ground operation reduction, which lead to an increased level of on-board autonomy in satellite mode management. availability requirements and have a need for ground operation reduction, which can lead to an increased level of on-board autonomy in satellite mode management. an increased level of on-board autonomy in satellite mode management. an increased level of on-board autonomy in satellite mode management. © 2017, IFAC (International Federation of Automatic Control) Hosting by Elsevier Ltd. All rights reserved. Keywords: Mission Control and Operations, Spacecraft Mode Management, Autonomous Keywords: Mission Control Control and and Operations, Operations, Spacecraft ModePhase, Management, Autonomous Keywords: Mission Spacecraft Mode Management, Autonomous Systems, Man-in-the-loop Launch and Early Orbit Geostationary Orbit, Keywords: Mission ControlSystems, and Operations, Spacecraft ModePhase, Management, Autonomous Systems, Man-in-the-loop Systems, Launch and Early Orbit Geostationary Orbit, Systems, Man-in-the-loop Systems, Launch and Early Orbit Phase, Geostationary Attitude and Orbit Control System Systems, Man-in-the-loop Systems, Launch and Early Orbit Phase, Geostationary Orbit, Orbit, Attitude and Orbit Control System Attitude Attitude and and Orbit Orbit Control Control System System 1. INTRODUCTION tonomy. Spacecraft can be endowed with a specific level 1. INTRODUCTION INTRODUCTION tonomy. Spacecraft canwhich be endowed endowed withthe specific level 1. tonomy. Spacecraft can be with aaa specific level of on-board autonomy, determines distribution 1. INTRODUCTION tonomy. Spacecraft canwhich be endowed withthe specific level of on-board autonomy, determines distribution Starting from the launch phase up to its disposal, and of on-board autonomy, determines the distribution responsibilities and which the corresponding capabilities of of on-board autonomy, which determines the distribution Starting from the launch phase up to its disposal, and of responsibilities responsibilities and thethe corresponding capabilities of Starting from the launch phase up its disposal, and in each mission phase, a satellite is to characterized by a of and the corresponding capabilities of the ground station versus spacecraft. From an operStarting from the launch phase up to its disposal, and of responsibilities and thethe corresponding capabilities of in each each mission mission phase, awhose satellite is characterized characterized by aa the the ground station versus spacecraft. From an operin phase, a satellite is by well-defined set of modes, definition and operational ground station versus the spacecraft. From an operational point of view, on-board autonomy can be actually in each mission phase, awhose satellite is characterized by a the ground station versus the spacecraft. From an operwell-defined set of modes, definition and operational ational point of view, on-board autonomy can be actually well-defined set modes, operational implication are step indefinition any spaceand mission design ational point of autonomy can be regarded as migration of functionality ground well-defined set aaof ofrelevant modes, whose whose definition and operational ational of view, view, on-board on-board autonomyfrom can the be actually actually implication are relevant step in inThis any is space mission design regarded regardedpoint asthe migration of functionality functionality from the ground implication are a relevant step any space mission design and spacecraft manufacturing. actually a system as migration of from the ground segment to flight segment, see Grant et al. (2006). In implication are amanufacturing. relevant step inThis any is space mission design regarded asthe migration of functionality from the ground and spacecraft actually a system system segment to flight segment, see Grant et al. (2006). In and spacecraft manufacturing. This is actually a engineering discipline and has to take into account the segment to the flight segment, see Grant et al. (2006). In this respect, Esteve et al. (2012) account for some keyand spacecraft manufacturing. This is actually a system segment to the flight et segment, see account Grant etfor al. some (2006). In engineering discipline and has to to take into into account the this this respect, Esteve al. (2012) (2012) keyengineering discipline and has take account the complete life-cycle of a satellite, especially its operational respect, Esteve et al. account for some keyfactors, that is to say mission type, mission objectives and engineering discipline and has to take into account the this respect, Esteve et al. (2012) account for some keycomplete life-cycle of a satellite, especially its operational factors, that is to say mission type, mission objectives and complete life-cycle of especially operational constraints and requirements. satellite its mode can be factors, that is type, mission objectives and priorities, type of say themission spacecraft orbit, spacecraft ground complete life-cycle of aa satellite, satellite,A operational factors, that is to to say type, mission objectives and constraints and requirements. Aespecially satellite its mode can be priorities, priorities, type ofoperations themission spacecraft orbit, spacecraft ground constraints and requirements. A satellite mode can be regarded as a clearly identified configuration of both sateltype of the spacecraft orbit, spacecraft ground visibility profile, concepts, and communication constraints and requirements. A satellite mode can be priorities, type of the spacecraft orbit, spacecraft ground regarded as a clearly identified configuration of both satelvisibility profile, profile, operations concepts, concepts, and communication regarded as clearly identified configuration of satellite platform payload hardware and software. operations communication constraints. Its traditional notion as and predefined explicit regarded as aa and clearly identified configuration of both both Every satel- visibility visibility profile, operations concepts, communication lite platform platform and payload hardware and software. software. Every constraints. Itsfulfill traditional notion as and predefined explicit lite and payload hardware and Every satellite mode has operational implications, meaning that constraints. Its traditional notion as predefined explicit behaviors can the needs for satellites operating in a lite platform and payload hardware and software. Every constraints. Its traditional notion as predefined explicit satellite mode has operational implications, meaning that behaviors can fulfill the needs for satellites operating in satellite mode has operational implications, meaning that each satellite mode allows a specific set of operations in behaviors can fulfill the needs for satellites operating in aa predictable environment. However, this approach is not adsatellite mode mode has operational implications, meaning that behaviors can fulfill the needs for satellites operating in a each satellite allows a specific set of operations in predictable environment. However, this approach is not adeach satellite mode allows a specific set of operations in order to fulfillmode operational and environment. However, this approach is not adequate for spacecraft operating in unpredictable contexts, each satellite allows aobjectives specific set of requirements, operations in predictable predictable environment. However, this approach is not adorder to fulfill operational objectives and requirements, equate feature for spacecraft spacecraft operating in unpredictable unpredictable contexts, order to operational objectives and see Eickhoff (2012). Initialization of a mode (at satellite, equate for operating in which deep space exploration systems orcontexts, critical order to fulfill fulfill operational objectives and requirements, requirements, equate feature for spacecraft operating in unpredictable see Eickhoff Eickhoff (2012). Initialization of includes a mode mode (at satellite, which deepsuch space exploration systems or orcontexts, critical see (2012). Initialization of a (at satellite, subsystem, instrument or unit level) the configuwhich feature deep space exploration systems critical operational phases as automated spacecraft docking. see Eickhoff (2012). Initialization of a mode (at satellite, which feature deep space exploration systems or critical subsystem, instrument or unit level) includes the configuoperational phases such as automated spacecraft docking. subsystem, or unit level) includes the configuration of theinstrument necessary hardware and software, periodic operational phases such as automated spacecraft docking. Further drivers for rich on-board autonomy are the overall subsystem, instrument or unit level) includes the configuoperational phases such as automated spacecraft docking. ration of of the the necessary necessary hardware and software, the periodic Further Further drivers drivers for rich on-boardavailability autonomy and are the the overall ration hardware and periodic transmission of telemetry packets, thesoftware, periodicthe acquisition for rich on-board autonomy are overall improvement of the spacecraft reliability, ration of the necessary hardware and software, the periodic Further drivers for rich on-boardavailability autonomy and are the overall transmission ofparameters, telemetry packets, packets, theactivation periodic acquisition acquisition improvement of the spacecraft reliability, transmission of telemetry the periodic of telemetry and the of all the improvement of the spacecraft availability and reliability, and the reduction costs in ground segment transmission ofparameters, telemetry packets, theactivation periodic acquisition improvement of theof spacecraft availability andoperations, reliability, of telemetry and the of all the and the reduction of costs in ground segment operations, of telemetry parameters, and the of all automatic processes required to achieve the mode, the reduction costs which address of long-term planningsegment insteadoperations, of day-toof telemetry parameters, and the activation activation of monitor all the the and and thecan reduction of costs in in ground ground segment automatic processes required to achieve achieve the mode, mode, monitor which can address long-term planning insteadoperations, of day-toautomatic processes required to the monitor its health status, and stay within in a stable manner. which can address long-term planning instead of day procedures, see van der Ha (2003). automatic processes to achieve the mode, monitor which can address long-term planning instead of day-today-toits health status, status, andrequired stay within within in aa stable stable manner. day procedures, see van der Ha (2003). its health and stay in manner. day see van der Ha (2003). its healthimportant status, and stayis within in a stable manner. day procedures, procedures, seeon van Ha management (2003). Another topic the definition of the autonomy This paper focuses theder mode approach for Another important topic istransitions, the definition definition of the the autonomy paper focuses focuses on the the mode management management approach for Another the of autonomy level for important spacecraft topic modeis which impacts the This paper on mode approach for aThis geostationary earth observation satellite system during Another important topic istransitions, the definition of the autonomy This paper focuses on the mode management approach for level forspacecraft spacecraft modeand which impacts the athe a geostationary geostationary earth observation satellite system during level for spacecraft mode transitions, which impacts the overall design the mission operational conearth during Launch and Early Orbit Phase satellite (LEOP)system and when the level forspacecraft spacecraft modeand transitions, which impactsconthe the a geostationary earth observation observation satellite system during overall design the mission operational Launch and Early Orbit Phase (LEOP) and when the overall spacecraft design the operational concept. Spacecraft autonomy is a matter of degree Launch Early Orbit Phase and when satellite hasand reached Geostationary Orbit It overall spacecrafton-board design and and the mission mission operational con- the the Launch and Earlythe Orbit Phase (LEOP) (LEOP) and(GEO). when the the cept.isSpacecraft Spacecraft on-board autonomy is aa matter matter of (2007). degree satellite has reached the Geostationary Orbit (GEO). It cept. on-board autonomy is of degree and continuously increasing, see Jonsson et al. satellite has reached the Geostationary Orbit (GEO). It draws on a real space mission project currently carried cept. Spacecraft on-board autonomy is a matter of (2007). degree satellite has reached themission Geostationary Orbit (GEO). It and is continuously increasing, see Jonsson et al. draws on a real space project currently carried and continuously Jonsson al. The ECSS-E-ST-70-11C (2008) see defines four et of au- draws on a real space mission project currently carried and is is continuously increasing, increasing, see Jonsson etlevels al. (2007). (2007). draws on a real space mission project currently carried The ECSS-E-ST-70-11C (2008) defines four levels of auThe The ECSS-E-ST-70-11C ECSS-E-ST-70-11C (2008) (2008) defines defines four four levels levels of of auau-
Copyright © 2017 IFAC 7512 2405-8963 © 2017, IFAC (International Federation of Automatic Control) Hosting by Elsevier Ltd. All rights reserved. Copyright © 2017 IFAC 7512 Copyright ©under 2017 responsibility IFAC 7512Control. Peer review of International Federation of Automatic Copyright © 2017 IFAC 7512 10.1016/j.ifacol.2017.08.1371
Proceedings of the 20th IFAC World Congress 7242 Massimo Tipaldi et al. / IFAC PapersOnLine 50-1 (2017) 7241–7246 Toulouse, France, July 9-14, 2017
out at OHB System AG. Such space mission will provide Europe with an operational satellite system able to support accurate prediction of meteorological phenomena and the monitoring of climate and air composition through operational applications. As a rule, geostationary satellites have continuous ground visibility with very small communication delay. If needed, they can be operated in a quasi real-time fashion, therefore a limited level of onboard autonomy can be sufficient. However, due to their mission objectives, they may have very high availability requirements, as loss of service has economical consequences. They may also have a need for reduction in ground operation intervention. These factors can imply increasing the on-board autonomy. Thus, we have two extreme cases, either the ground operators drive the complete satellite mode transition down to each reconfigurable HW or SW unit by executing a step-by-step procedure and uploading the related telecommands, or the ground operators send a telecommand to trigger a mode transition with the satellite converting it into a series of on-board operations for the spacecraft subsystem reconfiguration. Some satellite mode transition can be implemented with the former approach, others with the latter. In the solution hereafter proposed, satellite mode transitions triggered by critical on-board detected failures are autonomously managed by the Onboard Software (OBSW). As for nominal ground operations, the first approach is basically preferred with some very few exceptions. This paper also shows the link between the satellite and the Attitude and Orbit Control System (AOCS) modes during the LEOP and GEO phases. It has been organized as follows. Section 2 provides the operational meaning of the satellite, AOCS, and payload modes. Section 3 describes the approach for satellite mode transition, in particular it distinguishes between the man-in-the-loop mode transitions and the ones carried out autonomously by the spacecraft. Section 4 shows how the satellite and AOCS mode change during the LEOP phase up to the transition into the GEO orbit. Section 5 focuses on satellite and AOCS mode management during the GEO phase. Finally, section 6 concludes the paper. 2. SATELLITE MODE DEFINITIONS
•
•
•
•
The operational concept of a typical spacecraft includes one or more safe mode configurations that represent the ultimate reaction to spacecraft severe anomalies. In safe mode, the communication link to ground, a specific power supply profile, and thermal survival functions for relevant equipment are maintained, whereas all nonessential onboard units/subsystems are powered off, some subsystems/units can be switched to redundant hardware parts, and the spacecraft is (automatically) oriented to a particular attitude with respect to the Earth or the Sun, see Tipaldi and Bruenjes (2015). Safe mode has to be carefully conceived in terms of spacecraft configuration, observability, and commandability (for instance, OBSW dump and patch functions). The payload modes shall be compatible with the primary satellite modes. We can identify the following payload basic modes: • In Survival Mode, the payload is off, however the satellite platform enables the protection devices, such as the survival thermal lines. • In Stand-by mode, the payload is on and some basic monitoring and power lines are activated. • In Wait Mode, the payload is ready to operate. AOCS a-priori compensation for the scanning movement of the payload is activated, see Gimenez et al. (2005). • In Operational mode, the instrument is fully operable and provides science data.
Modes are conceived at satellite, AOCS, and payload level. The following satellite modes can be defined (see Fig. 1): • The satellite is in Launch Mode (LAM) from the moment of transfer of power provision from ground to the on-board batteries, until satellite separation from the launcher. During LAM, the satellite batteries are powered, the S-band receivers are on, one S-band transmitter is on, and the satellite communication buses are initialized. After having enabled all the analog and digital acquisition/commanding lines, the On-board Computer (OBC) waits for the separation signal to start the separation sequence. Survival thermal control functionality is also guaranteed. • At detection of launcher separation by the OBC, the satellite enters automatically the Sun Acquisition Mode (SAQ) and executes the separation sequence. Solar panels are oriented towards a specific reference position (the platform has a solar-array driving mechanism), and the Sun pointing has to be reached and
maintained. The SAQ can be also entered upon a Ground TC. In Nominal Mode (NOM), the satellite along its payload is fully operational. The satellite is threeaxes stabilized ensuring the required high pointing accuracy of +Z face (see Fig. 2) towards the Earth in order to provide mission product data and services, once configured, in a autonomous way. The Yaw Flip Mode (YFM) is required at each equinox to avoid direct Sun illumination of the satellite −Y face due to thermal reasons (the only radiator is placed on the −Y face). The satellite will rotate around the Z axis thanks to its reaction wheels. In Stand-by Mode (SBM), the satellite acts as an inorbit spare not used for any operational service but able to become operational within a short time frame. Full health and safety activities are maintained, including continuous real time monitoring. Thrusters are disabled via the latch valves system. The satellite enters the Safe Mode under critical on-board anomaly detection, which cannot be autonomously recovered or which, though recovered, could present a risk later on if normal operations are continued. Return to normal operations is completely carried out under ground control.
The management of payload modes is under direct Ground control (which means that mode transition TCs are directly routed to the payload). The spacecraft switches automatically payload modes in defined failure cases, such as during the transition into safe mode. In the same way, the AOCS modes shall be compatible with the primary satellite mode. The following AOCS modes are defined:
7513
Proceedings of the 20th IFAC World Congress Massimo Tipaldi et al. / IFAC PapersOnLine 50-1 (2017) 7241–7246 Toulouse, France, July 9-14, 2017
7243
Fig. 1. Satellite modes and corresponding transitions • The Station Keeping Mode (SKM) is entered to perform attitude control manoeuvres via the reaction wheels, orbit correction manoeuvres via the thrusters, and reaction wheel off-loading by means of the thrusters. • Fine Pointing Mode (FPM) is used for precise satellite attitude manoeuvres. It is performed via the reaction wheels and is devoted to the payload operations. Stable pointing is guaranteed, for instance the disturbance of the payload can be compensated by feedforwarding its nominal torque. • The Survival Mode (SRM) performs a stabilized and robust Sun pointing in case of critical failure, independently of ground support. Fig. 2. Satellite axis orientation in nominal mode • In STBY mode all the sensors and the actuators are available, however any closed loop actuation is not applied, therefore neither the thrusters nor the reaction wheels are commanded by the AOCS. • In Sun Acquisition Mode (SAM), the AOCS damps high angular momentum, points the −Z face towards the Sun, and spins around the Z axis. • The Guided Attitude Mode (GAM) is designed to allow any kind of pointing and to perform small attitude manoeuvres, thus increasing the flexibility of operations of the satellite. GAM is commanded with a guidance profile to be tracked, uploaded from ground. GAM is used as an intermediate mode, to achieve defined attitude states, which are needed, e.g., at the beginning of orbit transfer manoeuvres. • The Orbit Transfer Mode (OTM) gives the capability of performing the transfer to GEO using the Liquid Apogee Engine (LAE), while maintaining the attitude compatible with this orbit correction. The mode is provided with a guidance profile uploaded from ground with a format similar to the one used in GAM.
We mention the type of AOCS sensors used in our space mission to provide a better insight into its AOCS architecture: star tracker, gyroscope, coarse rate sensor, and coarse Sun sensor. Finally, satellite, payload, and AOCS modes are observable by Ground via relevant telemetry packets. 3. SATELLITE MODE TRANSITIONS In the solution illustrated in this paper, spacecraft mode transitions are normally carried out by the ground segment, which first transmits to the satellite a series of telecommands necessary to perform the corresponding subsystem/satellite unit configuration, and then the actual satellite mode transition. In European space projects, structures for all the telecommands and telemetry are based on the Packet Utilization Standard, see ECSS-E70-41A (2003). Fig. 3 outlines the relationship among Satellite, AOCS, and Payload modes in the different mission phases. Initialization of a satellite mode includes the configuration of all the necessary hardware and software, the activation of the mode-specific telemetry parameters acquisition, the activation of the mode-specific telemetry packets generation, the activation of the mode-specific
7514
Proceedings of the 20th IFAC World Congress 7244 Massimo Tipaldi et al. / IFAC PapersOnLine 50-1 (2017) 7241–7246 Toulouse, France, July 9-14, 2017
3.1 AOCS Sub-modes in Sun Acquisition Mode
Fig. 3. Satellite, AOCS and paylaod mode combination in each mission phase
The purpose of the Sun Acquisition Mode (SAM) is to acquire a stable Sun pointing attitude for all initial conditions. This is achieved by applying a control, that reduces high values of initial rotation (or initial angular momentum), slews the spacecraft such that the −Z face is pointing towards the Sun, and enables a slow spinning of the spacecraft around the Z axis. The reduction of the initial angular rates of the satellite can be achieved first by using the thrusters and then by using the reaction wheels. This is why SAM consists of three sub-modes: Thruster Detumbling (TD), Thruster Sun Acquisition (TSA), and Reaction Wheel Sun Acquisition (RWSA). The logic of sub-mode selection in SAM is shown in Fig. 4. At launch, the parameter PAR SaSubModeSet and the AOCS SAM submode are respectively set to NONE and TD. As consequence, the SAM always starts with TD. As soon as the rates are below the threshold, SAM switches from TD to either TSA or RWSA in the next AOCS cycle according to the following rule: • RWSA is selected if at least four reaction wheels are on and healthy. • TSA is selected if less than four reaction wheels are on and healthy. Since the spacecraft is launched with all the reaction wheels in off condition, the TSA sub-mode is automatically entered. On the other hand, during the GEO phase, the parameter PAR SaSubModeSet is overwritten, thus the AOCS enters the commanded submode and stays there (see the left side of the Fig. 4). RWSA provides some advantage over TSA, that is to say, reduced fuel consumption and low orbit disturbance.
Fig. 4. AOCS sub-mode transitions in SAM 3.2 Separation Sequence SW processing and/or algorithms, and the AOCS/payload mode transition. Finally, the command for the actual satellite mode transition is sent to the spacecraft. All these steps have to be carried out by the ground operators through a well-defined procedure. They have also to check the correctness of the command execution. Besides this, satellite mode transitions can be triggered autonomously by the OBSW in case of level 3 or level 4 failures (failure level definition is described in Tipaldi and Bruenjes (2015)) or in very limited nominal operations, for example, during the transition from LAM to SAQ at the beginning of the separation sequence. When level 3 or level 4 failures occur, the satellite can enter automatically either the SAQ or the safe mode (see Fig. 1). Interesting is the case that when the AOCS is in FPM mode, the first occurrence of level 3 failure is not managed by downgrading the satellite to a lower configuration. In this case, the tradeoff between safety versus mission completion has privileged the latter, see Tipaldi and Glielmo (2016). The remaining part of this chapter describes the AOCS SAM and the separation sequence in more details. This information is necessary for a better understanding of the satellite LEOP phase.
The separation sequence starts after the actual separation from the launcher. It aims at bringing the satellite into a safe and stable configuration with the solar arrays deployed and −Z face pointing to Sun without any need for ground operation during this sequence. The satellite mode is set to SAQ, whereas the AOCS mode can be either SBTY or SAM. All the AOCS manoeuvres are carried out by means of the thrusters since all the reaction wheels are off. The activities performed during the Separation Sequence are: • Venting, and then pressurization of the propulsion subsystem: the AOCS mode is set to STBY. • Spacecraft rate damping and attitude control by means of thrusters: the AOCS mode is set to SAM, the sub-mode to TD, and then to TSA once the spacecraft rate is lower that a specific threshold. • Deployment of the solar array: the AOCS mode is set to STBY The separation sequence ends after the solar array deployment with the AOCS mode set to SAM and the AOCS sub-mode set to TSA.
7515
Proceedings of the 20th IFAC World Congress Toulouse, France, July 9-14, 2017 Massimo Tipaldi et al. / IFAC PapersOnLine 50-1 (2017) 7241–7246
7245
The transition into SAQ/GAM is performed via TC by the ground operator. GAM is used as an intermediate mode, to achieve the necessary attitude states at the beginning of orbit transfer manoeuvres. This adjustment of the satellite attitude is achieved by a guidance profile, uploaded from ground. GAM is associated with a time out: when the time-out expires, AOCS performs an autonomous transition into SAM. In OTM, the LAE is used for the orbit manoeuvres, whereas the thrusters for the attitude control are used. For each LAE burn, ground operators determine and upload the change in velocity and the attitude profile. When the OTM manoeuvre is completed, ground can command the transition into SAQ/SAM to adjust the Sun pointing when needed.
5. MODE TRANSITIONS IN GEO
Fig. 5. Satellite mode management in LEOP 4. MODE TRANSITIONS IN LEOP The satellite and AOCS mode management during the LEOP phase is shown in Fig. 5. The following satellite/AOCS modes are used: • Separation sequence: SAQ/STBY (for propulsion initialization), SAQ/SAM(AOCS submode set to TD, and then TSA), and SAQ/STBY (for solar array deployment). • Preparation for the transfer to the GEO orbit: SAQ/SAM (AOCS submode set to RSWA), and SAQ/GAM. • Transfer to the GEO orbit: SAQ/OTM, SAQ/SAM, and end of LEOP. At completion of separation sequence, the spacecraft is in Sun pointing attitude with solar panels deployed and the AOCS is in SAM-TSA, the satellite mode is SAQ. Afterwards, the reaction wheels are switched on by ground through a specific flight operation procedure. This enables the automatic transition into SAM-RWSA. As a result, the complete operation is accomplished via a hybrid thrusters and reaction wheels strategy, very suitable for large angle and rapid spacecraft reorientation, see Ye et al. (2012). Thrusters can provide a larger control torque, but can not be used to achieve high control accuracy, see Sidi (2000). Another disadvantage of thrusters is their fuel consumption. Conversely, reaction wheels are capable of finer control for high precision control demand. In addition, reaction wheels consume only electrical energy. The idea of incorporating both thrusters and reaction wheels is to take advantage of the strong points of each individual type of actuators. Thrusters can be used during the whole separation sequence, afterwards ground can decide to enter the RWSA sub-mode to provide the fine control torque.
The satellite and AOCS mode management during the GEO phase is shown in Fig. 6. The satellite mode set-up and transitions are completely performed by the ground operators with the exception of level 3 or level 4 failures, which are managed by automatic transition either into SAQ or Safe mode. The first transition from SAQ into NOM is executed during commission phase after arrival on the GEO location. The following steps are executed by Ground: SAQ/SAM → SAQ/GAM → NOM/SKM → NOM/FPM. Once the momentum and the angular rate in SKM mode are below a specific threshold, a transition into FPM mode can be performed. AOCS a-priori compensation is started and the payload can be configured in order to provide the required mission product data and services. The SKM can also enter autonomously the FPM if after the time-out expiration the dynamics entry conditions on angular error and rate error are satisfied. If the dynamic conditions for FPM are not reached when the SKM timeout expires, the spacecraft remains in SKM. The abovementioned procedure is also executed from Ground after level 3 failure. Moreover the transition from SAQ mode into NOM mode also occurs as part of the recovery from Safe Mode, where the ground recovery procedure foresees a transition from Safe Mode to SAQ/SAM and then continues up to NOM mode. From NOM mode the spacecraft mode can enter the SBM mode. Ground has to command payload into WAIT mode as well as to stop any AOCS a-priori compensation. From NOM mode, ground can also initialize transition in YFM mode, provided that the payload is in WAIT mode and the AOCS a-priori compensation has been stopped. The YFM mode can also be entered from the SBM mode. In YFM mode, the AOCS remains in FPM for the rotation around Z axis. Ground determines the direction of rotations, pending on the hour of day for the manoeuvre. The transition into Safe Mode is performed automatically: as for the relevant satellite units, their redundant part is activated (for instance as for the OBC, the redundant processor module is used), whereas the not-essential units are off. Ground failure investigation in Safe Mode determines which units are healthy and available to try the re-boot into SAQ/SAM. The recovery procedure from Safe mode is completely under ground responsibility. In order to make use of RWSA sub-mode for fuel saving reason, ground
7516
Proceedings of the 20th IFAC World Congress 7246 Massimo Tipaldi et al. / IFAC PapersOnLine 50-1 (2017) 7241–7246 Toulouse, France, July 9-14, 2017
Fig. 6. Satellite mode management in GEO should switch on the reaction wheels whilst still in Safe Mode. 6. CONCLUSION AND FURTHER CONSIDERATIONS This paper has presented the mode definition and management for a geostationary earth observation satellite system during the Launch and Early Orbit Phase and the full operational phase. It draws on a real space mission project currently carried out at OHB System AG. A satellite mode defines a clear configuration of the spacecraft subsystems and has specific operational implications. The configurations of the Attitude and Orbit Control System are also analyzed. Autonomy requirements drive the design of the satellite modes. In this respect, it has been shown that geostationary satellites do not need a high level of onboard autonomy for satellite mode management. In the proposed solution, satellite mode transitions—triggered by critical on-board detected failures or during the separation sequence—are autonomously managed by the satellite to fulfill availability requirements. As for the nominal mode transitions, the ground operators drive the complete process down to each reconfigurable HW or SW unit by executing a step-by-step procedure and uploading the related telecommands. The authors regard this solution not suitable for deep space exploration missions, where a higher level of autonomy is needed. In such cases, only satellite mode transitions could be commanded by ground. Then, the spacecraft could configure autonomously all its subsystems according to the commanded spacecraft mode. The On-Board SW can drive the mode transition by executing and monitoring the reconfiguration actions of all the subsystems needed to enter the desired mode. A further evolution could be the complete autonomous spacecraft mode management during critical mission phases. All that can lead to a relevant reduction in ground operation costs.
Cooperation for Space Standardization. ECSS-E-ST-70-11C (2008). Space engineering - space segment operability. European Cooperation for Space Standardization. Eickhoff, J. (2012). Onboard computers, cnboard software and satellite operations: an introduction. Springer. Esteve, M., Katoen, J., Nguyen, V., Postma, B., and Yushtein, Y. (2012). Formal correctness, safety, dependability, and performance analysis of a satellite. In International Conference on Software Engineering (ICSE), 1022–1031. Gimenez, A., Langevin, Y., Barcons, X., Harrison, R., Appourchaux, T., Perryman, M., Balogh, A., and Coradini, A. (2005). Payload and mission definition in space sciences. Cambridge University Press. Grant, T., Soler, A., Bos, A., Brauer, U., Neerinex, M., and Wolff, M. (2006). Space autonomy as migration of functionality: the mars case. In Proceedings of Space Mission Challenges for Information Technology, 201– 208. Jonsson, A., Morris, R., and Pedersen, L. (2007). Autonomy in space current capabilities and future challenges. AI Magazine, 8, 27–42. Sidi, M.J. (2000). Spacecraft dynamics and control: a practical engineering approach. Cambridge University Press. Tipaldi, M. and Bruenjes, B. (2015). Survey on fault detection, isolation, and recovery strategies in the space domain. Journal of Aerospace Information Systems, 12, 235–256. Tipaldi, M. and Glielmo, L. (2016). State aggregation approximate dynamic programming for model-based spacecraft autonomy. In European Control Conference (ECC), 86–91. van der Ha, J. (2003). Trends in cost-effective mission operations. Acta Astronautica, 52, 337–342. Ye, D., Sun, Z., and Wu, S. (2012). Hybrid thrusters and reaction wheels strategy for large angle rapid reorientation with high precision. Acta Astronautica, 77, 149–155.
REFERENCES ECSS-E-70-41A (2003). Ground systems and operations telemetry and telecommand packet utilization. European 7517