- Email: [email protected]
AOOSY Automatic Orbital Operations System for Satellites and Space Probes
AOOSY Automatic Orbital Operations System for Satellites and Space Probes
Dr. Wolf-Udo Wagner Messerschmitt-Bblkow-Blohm GmbH Space Division Munich-Ottobrunn, Germany
ABSTRACT Orbital operation and flight performance of satellites and spaceprobes are conventionally controlled by engineers basing their command decisions on SIC telemetry signals which have been collected by a net of ground stations and which are displayed by different "quick-look" facilities within a central control center. A new system, called AOOSY, replaces quick-look facilities and many of the control engineers by a small process computer.
The objectives of the so-called "orbital operations" of a spacecraft are a) to guarantee optimum mission fulfilment, and b) to recognize failures and emergencies and to take the best remedial measures as soon as possible.
a) to evaluate nearly all telemetry data, b) to assess SIC status, c) to analyze possible malfunctions or failures d) to recommend a failure relief command' or to initiate this command instantaneously, e) to recommend or initiate all routine commands for optimal fulfilment of mission.
For these purposes "Quick Look" Systems are usually applied . With the Quick Look System the telemetered technical data from the satellite (the so-called "Housekeeping" values) are collected through the stations of a global ground station net (such as NASA , ESRO , CNES) and transferred in a more or less condensed manner to a central control station (such as Greenbelt for NASA Darmstadt for ESRO and Bretigny for CNES). There the data, i~ the form of printouts, plots or displays, will be evaluated by a group of control engineers. Then the necessary commards are considered for routine operation as well as for the situation in case of technical malfunctioning or failures. The central control station then advises one of the ground stations which commands to send to the satellite, or whether further data must be obtained.
The complete and quick response of AOOSY to SIC condition and mission requirements permits to reduce the ground station net and the control center facilities considerably. The basic principles of AOOSY are
1. Time dependent nominal values are calculated for nearly all telemetry channels (including the "scientific channels") before SIC passage. During the passage, actual and nominal values are compared.
With the aid of a relatively small process computer, AOOSY performs automatically a) mission planning and command generation for routine operations b) spacecraft control during contact with one or several ground stations c) instantaneous fault isolation and preparation of remedial measures.
2. The "overflow" of this comparison (called "actual deviation frame") characterizes a failure. From failure analysis and failure reports during SIC development, reasonably possible failures have been analyzed and responding "overflows" (called "nominal deviation frames") have been stored. Comparison of actual deviation frame with all nominal deviation frames allows failure allocation and designation of fa ilu re rei ief commands. The behaviour of the SIC outside of the ground stations' range can be evaluated from data stored on-board of the vehicle by a tape recorder.
4.
Excessive programming can be avoided by the introduction of some parameters which can be adjusted empirically during orbital operations.
Development and tests of AOOSY are sponsored by the German Ministry of Science and Education (BMWB).
INTRODUCTION
AOOSY allows within about one minute
3.
The development of AOOSY at Messerschmitt-Bblkow-Blohm GmbH will be completed until January 1970. It will be tested during the orbital operations of the German research satellite AZUR in 1970. Operational results will be available in March 1970.
By means of the high speed computation capability it is possible to evaluate all telemetry data acquired (technical information from scientific channels included), complete data evaluation and resulting failure allocation within fractions of a minute (remedial measures included) _ The monitoring of the satellite in positions which are not within the region of visibility of the ground stations will be accomplished semi-automatically by use of the on-board taped telemetry data.
260
The following advantages of AOOSY are apparent :
PRINCIPLE OF AOOSY
1. The complete and rapid data evaluation and the spontaneous command generation permit, in many cases, a reduction in the widespread and expensive net of "active" ground stations. Satellite monitoring and command transmission can be handled by a single ground station which has a high speed data channel to the control centre (and the AOOSY computer). (To acquire more real time data for scientific purposes it would be sufficient to have completely passive receiving stations which are automatic and unmanned.)
For the application of AOOSY it is required that a)
b) telecommands can be transmitted to the satellite during these contact times. The system still operates but with less efficiency when telecommands which have been deduced during one contact time can be transmitted during the next contact. In case of failure of the telecommand facilities AOOSY will still deliver spacecraft failure identification. '
2. The permanent data transmission lines between the control centre and the various active ground stations can be saved . 3. The personnel complement of active ground station can be saved. 4.
c)
In the control centre there will be a definite saving on personnel : a) The number of flight operations engineers can be greatly reduced. b) The engineers for monitoring the various active stations and the related data transmission facilities can be eliminated as well as the associated people and equipment for data preparation and display.
in case of spacecraft failures the satellite will survive during the interval between two contact times, since failure identification and correcting (emergency) commands can be derived only at the contact time following the spacecraft failure.
These three conditions are normal requirements for a spacecraft. They are also necessary for the conventional operations systems. (Standard ground station activities, such as demodulation of the rf signal, decommutation, command signal generation, etc. will not be considered here.)
5. The rapid and complete use of the complete telemetered technical information permits : a) rapid failure recognition and failure correction b) quick reaction to critical satellite conditions c) maximum mission completion through rapid flight operation handling and spontaneous failure correction. Time delays for human decisions, during which valuable date could be lost, will be avoided. d) Avoidance of human errors in decisions. (The preprogrammed automatic decisions of AOOSY contain the ~ide-ranging knowledge of the group which developed, Integrated and tested the satellite.) 6.
telemetered data can be acqu ired from the spacecraft during "contact times" between the satellite and the ground station to which AOOSY is linked . Contact times of less than one minute will be sufficient.
To demonstrate the principle of AOOSY, it has been assumed that two data down-links from the vehicle to the ground and one command up-link to the spacecraft exist. Further it has been assumed that data are encoded by time-multiplex PCM telemetry systems, which means that the different information channels of the spacecraft are sampled at regular time intervals, and the sampling results can be arranged in telemetry frames or formats. In one data down-link, the vehicle shall continuously transmit real time data which contain all technical information on the spacecraft (housekeeping values and scientific data)' The other data link may be used to transmit data which have been stored on board the spacecraft (playback of a tape recorder initiated by ground commands). Naturally, AOOSY could be similarly applied to other telemetry concepts.
Flight documentation and failure reporting are planned and standardized so that again less personnel is needed.
The continually transmitted real time data of the spacecraft will be utilized in the Real Time (Data) Orbital Operations System (RETOOSY) which is the most significant part of AOOSY . While R ETOOSY deals with the satellite's condition and perfo·rm ance at the moment of contact with the central ground station, the Taped Time (Data) Orbital Operations System (TATOOSY) treats satellite conditions which had occured recently. For this purpose all data which have been collected by the tape recorder on board the spacecraft are fed into the process computer during or after playback of the satellite's tape recorder.
7. The necessity for complete analysis of the mission, flight operations, and satellite relationships with normal and abnormal flight conditions "cross-fertilizes" the development of the spacecraft itself. 8. With one (relatively inexpensive) process computer more than one satellite can be monitored. 9. AOOSY is equally suited for monitoring space probes and in some cases also for rockets.
Technically significant channels of the TT data will be processed and plotted by TATOOSY. In this way satellite performance can be judged in those geograph ical positions of the spacecraft which cannot be "seen" from the central ground station. Thus T ATOOSY complements R ETOOSY and compensates for a net of distant ground stations. On the other hand, T ATOOSY is a much less important part of AOOSY because of the possibility of operating the satellite satisfactorily using RETOOSY alone.
10. This system is especially attractive for small countries, which still have not built their own ground station net or which, due to various reasons, will avoid building their own global net. Compared with these advantages the required expenditure for AOOSY is small. For the "hardware" items there are no additional costs, since the hardware for AOOSY is also necessary for the conventional "Quick Look" operation, and belongs to the normal ground equipment of a control centre and an active ground station. The "software" must be prepared anew for each satellite . However, in the development of each satellite very exact and wideranging functional and failure mode and effect analysis are made of the satellite systems and subsystems, on which the AOOSY programs can be based . The additional expenditure for the AOOSY software is still noticeable; however, it is small in comparison with the real saving.
Fig. 1 shows the block diagram of AOOSY logic. Rectangular blocks and solid lines signify automatic steps, elliptic blocks and dotted lines denote human activities. For the sake of brevity, only RETOOSY will be discussed. The first stage of R ETOOSY acquires actual technical data from the spacecraft ("actual frames" ), performs mission planning and command generation, calculates nominal technical data ("nominal
26 1
TA PED TIME (STORED ON
REAL TIME DATA
BOARD) DATA FROM
FR OM SPACEC RAFT
SPACECRAFT
COMMANDS TO SPACECRAFT
•••••• • ••• ••
••••••• •••••••••••••••••• DATA QUA LITY CHE CK
. • ••••••• ~
•• • •
· ·
I I
I
I
I I
•••
I
rI I
••••
I
I
I L_
---,
NOM INAL FRAME UPP ER LIMITS
I
•
I NOMINAL FRAME
I I
LOWER LI MITS
I
•
·•·
I
•
I • I
• • • ••
I
I
• • • • •• I • II
I I I I
I
I I I
/ /
L
I I I I
",
•
:
I
--U----J · :
RETOOSY
TATOOSY
•••••• • • • • • • • • • • • • • • • • • • • • • • • • • • • • 1 •• . . . . . . . . . . . .
AOOSY
CJ ---
c::> ---
fIG . 1:
AUTOMA T IC OPERA"I ION
HUMAN OPERAT ION
THE PRINCIPLE OF AOOSV
RETDOSY • REAL TIME I DATA I ORBITAL OPERATIONS SYSTE M T ATOOSY = TAPED TIME (OATA ) ORBI T AL OPERA TION S SYSTE:-.A
262
frames") and compares actual frames with nominal frames. As long as actual data are in accordance with nominal predicted values, the system stops"after having delivered a short printout as to spacecraft status.
periods could give more insight into the malfunctioning under consideration. This information is provided by TATOOSY. To establish the "nominal deviation frame" which belongs to a definite component or system failure, the effect of the failure has to be traced throughout the whole spacecraft. This is standard practice for failure mode and effect analysis which will be combined with the functional logic of the complete system. When all effects of a certain failure have been found, it can be associated with changes of the frame content, channel by channel. Depen· dencies of the nominal deviation frames on spacecraft operation mode can be eliminated by definite "blurring" or by introduction of multiple nominal deviation frames.
If actual data differ from nominal data, the difference will be stored within the "actual deviation frame" and failure allocation including first remedial actions will be initiated (second stage of R ETOOSY). The actual deviation frame will characterize the failure. Based on failure mode and effect analysis on the one hand, and on failure reports on the other, the effect of each possible failure on frame content has been considered during the preparation of orbital operations. In this way, a "nominal deviation frame" has been established for each failure. Com· parison of the actual deviation frame with all stored nominal deviation frames allows "(preliminary) failure identification".
It could occur that a possible spacecraft failure is forgotten during the preparation of orbital operations. In this case, no nominal deviation frame can be found which is comparable to the actual deviation frame. Now the computer will print the actual frame, the nominal frames and the actual deviation frame without starting fu rther action except to alarm control centre personnel. However, it seems rather improbable that many failures could be ignored during a carefu I preparation of orbital operations.
The programme system "mission profiles" allows a) prediction of contact times for all ground stations as well as other operational events, for instance shadow times, times in the radiation belt, etc. b) calculation of optimum mission course and necessary commands which must be transmitted to the spacecraft for optimum mission fulfilment, c) deduction of the operating condition of all satellite equipment (on, off, receipt of commands, switching of relays), etc., d) supply of input data for the adjoined programmes which predict performance and technical data for the spacecraft subsystems.
To make sure that failure identification has not been erroneous or to distinguish between failures which result in the same deviation frame, an appropriate test command will be initiated as the next step. Depending on spacecraft design, this will be useful only for a certain amount of all failures. The test command must lead to a definite predetermined actual deviation frame. If this frame has been found after command execution, the "final failure identifi· cation" has been achieved:
Besides technical characteristics of the satellite, mission require· ments and orbital elements which are constants of the pro· grammes, the only required inputs are mission data and mission condition (desired scientific or appl ication programme of the spacecraft).
After the final failure identification, the stored failure relief command will be delivered to the spacecraft. In relation to each failure, the optimum failure relief command was selected during the preparation of orbital operations. In many cases, no failure relief will be possible, in other cases, a perfect failure relief can be achieved by switching over to redundant systems.
Mission profiles and prediction programmes calculate off·line all "words" (1 bit, 6 bit, 12 bit, etc.) of the data frames which will be transmitted by the spacecraft during the coming passages. In cases where calculated results have large uncertainties (i .e. the difference between upper and lower limits becomes undesirably large), values which have been measured during the first orbits may be inserted into the nominal frames: flight results serve for correction of nominal frames by control centre personnel. Predicted data are arranged to form the upper and lower limit of the "nominal frame" which will be compared on·line with the "actual frame" dlJring the spacecraft's passage.
As long as no failures occur, it will be sufficient to have limited printout on spacecraft status (i.e. mission programme, battery charging, etc.). In case of failures, comprehensive standardized documentation will be initiated automatically and printouts of actual frame, nominal frames, actual deviation frame, failure identification and remedial actions will be delivered. Depending on the spacecraft, special documentation may be derived from RETOOSY stored data. Some data will be used to correct prediction programmes and to adjust the failure identification programmes for those cases where spacecraft will remain permanently in faulty condition.
Before comparison, the serial PCM RT·data of the spacecraft have to be controlled as to whether they meet the requirements for decommutation. If requirements are not met, the "data quality check" will initiate commands which will switch the satellite's (telecommunication and power) systems into possible back·up modes of operation. As soon as necessary data quality has been established, all RT data can be decommutated and stored as "actual frame".
FIRST APPLICATION MODEL R ETOOSY will be tested during the flight of the first German research satellite AZU R. For this purpose, commands will be derived automatically but they may be transmitted manually to the satellite. During final testing, RETOOSY will operate simul· taneously with the conventional Quick Look System. (TATOOSY will be realized to some extent by the so·called Quick Look C which serves for evaluation of taped time data.) In the following some notion of the development for this application will be given. Experimental results will be given during the oral presentation in March 1970.
Besides straightforward comparison of actual and nominal frames, some words of the actual frame are fed into small special "check·out programmes" which search for violation of forbidden values. These forbidden values would be significant symptoms for failures. The comparison of both frames delivers those words which are out of limit together with some indication as to which limits have been violated or which forbidden values have been found, respectively. All this information forms the content of the "actual deviation frame". The actual deviation frame will contain all telemetered information concerning a failure in the spacecraft. Only investigations on the satellite's behaviour during longer
The telemetry cycle time for complete build·up of one data frame is 10 sec. To prevent errors caused by spurious signals during data acquisition, RETOOSY will use two frames in case of failure recognition. Besides this basic double·cycle time which is deter· mined by the satellite's telemetry system, RETOOSY needs
263
100 msec to control all 130 different information channels (1 bit,6 bit, 12 bit and 24 bit) less than 3 sec to find the right one among 1000 to 2000 nominal deviation frames in case of a spacecraft failure.
All other programmes have been written directly in the assembler language PROSA. All programmes and data will be stored on the disk. After completion of the first stage of RETOOSY (comparison of actual and nominal data, 0.1 sec), the core memory will be loaded with programmes for the second stage (failure allocation) if the actual deviation frame does not disappear. By using an exchange buffer storage, all nominal deviation frames will be transferred from the external disk storage and can be compared with the actual deviation frame in less than two seconds.
For each telemetry cycle, the following values will be printed on the typewriter Printout Format 1 : a) number of data frame relative to commencement of contact with sa te 11 ite b) mission status (radiation belt, calibration programme, etc.) c) battery status (charge, discharge, trickle charge, on, off, critical, not critical, no statement) d) in case of failure: number(s) of nominal deviation frame, test command, relief command e) and only once per contact time the date, time, and the absolute number of the data frame derived from the satellite's clock.
CONCLUSIONS A system has been described wh ich allows automation of orbital spacecraft control with the aid of a process computer. It has been developed for tests during orbital operations of the German satellite AZUR. Similar systems could be applied to other satell ites and space probes.
If one of the temperature sensors indicates excessive temperature and/or if the spacecraft is in an unpredicted switching state, this will be shown by two additional print·out formats on the high speed printer. Print-out Format 2 will show which equipment violates temperature limits, and Print-out Format 3 will show the complete actual switching state inclusive of an indication as to which equipment should be "on" instead of "off" and vice versa.
ACKNOWLEDGEMENTS The development of the first application model of RETOOSY has been sponsored by the German Ministry of Science and Education (BMWB) represented by the Gesellschaft fur We:traumforschung (GfW), contract number RV 5-620/ 17/ 68.
For documentation purposes, the actual frame, the nominal frames and the actual deviation frame will be stored on tape whenever a failure has been indicated by RETOOSY. The Siemens process computer P 305 will be used for all calculations. Mission profiles and time-dependent nominal data will be calculated off-line several days in advance and stored on the disk. As the core mernory of the Siemens P 305 contains only 16 K words, many transfers will be necessary during these calculations, but establishment of nominal frames is fully automatized. The rather involved programme system for mission profiles and prediction of nominal data had originally been written in FORTRAN 63 for a CDC 3800 but then had been recoded into FORTRAN 300 which is accepted by the compiler of th is process computer.
KEY WORDS automatic control orbita I operations quick-look system spacecraft contro I
DISCUSSION
Q.
How many tel eme tric channels are attached and how many commands can it give? A.
:\ core rnern.ory is 16 K \\'ords, eaLh 1\'ord
~" Y"' ~! ~.~! 11 •
24 bits. Most o f the mel~r,n' i~ .',' ;: di,.;: 1","',' ,-, Ivhjch hils some mjlli0n \l'o I'd " , :'11c ,, ]).)1("], ,': ',"':"11'" is several hundred K \,·ords.
For the first Ferman spacecraft we have 130 different channels having information of one bit, six bits, twelve bits or even more and we have 70 commands available to arc on the spacecraft.
A.
Hm-e you iln\' results of tho sys t em?
Q.
Q. What are the technical characteristics of the memory devices and the reliability of the whole sYstem? What is the connection with the logic of the system?
OI'C ,' :'t I'.'I! :.,
~h
i.'
A. The ,;\'sterl i" nOl, under~oin" tcst '~ '·c, :·,ti,'n" \vith the ~pacecrilft. lIe mu~t adiCl,;t t:~c "1·.'c !:1'" "'ith some nh\',;ical \-alues like solar n;1(1.: le rerturbilti~n~. The I-ir"t result" "ho'., 0,' th ,t i, opeTil t es as the check.
This is basically a grOlmd system which means that reliahility problems are on an0ther level than the spAcecraft. \Ve are using a very small process computer having only a very small core memory of 16 K words but with a very large external memory on the gr0und. For all the calculations we make a lot of transfer between the core memory and the external memory. During the passage we operate with the nominal actual data in the small core memory. A.
264
Dr. Wolf-Udo Wagner Messerschmitt-Bblkow-Blohm GmbH Space Division Munich-Ottobrunn, Germany
ABSTRACT Orbital operation and flight performance of satellites and spaceprobes are conventionally controlled by engineers basing their command decisions on SIC telemetry signals which have been collected by a net of ground stations and which are displayed by different "quick-look" facilities within a central control center. A new system, called AOOSY, replaces quick-look facilities and many of the control engineers by a small process computer.
The objectives of the so-called "orbital operations" of a spacecraft are a) to guarantee optimum mission fulfilment, and b) to recognize failures and emergencies and to take the best remedial measures as soon as possible.
a) to evaluate nearly all telemetry data, b) to assess SIC status, c) to analyze possible malfunctions or failures d) to recommend a failure relief command' or to initiate this command instantaneously, e) to recommend or initiate all routine commands for optimal fulfilment of mission.
For these purposes "Quick Look" Systems are usually applied . With the Quick Look System the telemetered technical data from the satellite (the so-called "Housekeeping" values) are collected through the stations of a global ground station net (such as NASA , ESRO , CNES) and transferred in a more or less condensed manner to a central control station (such as Greenbelt for NASA Darmstadt for ESRO and Bretigny for CNES). There the data, i~ the form of printouts, plots or displays, will be evaluated by a group of control engineers. Then the necessary commards are considered for routine operation as well as for the situation in case of technical malfunctioning or failures. The central control station then advises one of the ground stations which commands to send to the satellite, or whether further data must be obtained.
The complete and quick response of AOOSY to SIC condition and mission requirements permits to reduce the ground station net and the control center facilities considerably. The basic principles of AOOSY are
1. Time dependent nominal values are calculated for nearly all telemetry channels (including the "scientific channels") before SIC passage. During the passage, actual and nominal values are compared.
With the aid of a relatively small process computer, AOOSY performs automatically a) mission planning and command generation for routine operations b) spacecraft control during contact with one or several ground stations c) instantaneous fault isolation and preparation of remedial measures.
2. The "overflow" of this comparison (called "actual deviation frame") characterizes a failure. From failure analysis and failure reports during SIC development, reasonably possible failures have been analyzed and responding "overflows" (called "nominal deviation frames") have been stored. Comparison of actual deviation frame with all nominal deviation frames allows failure allocation and designation of fa ilu re rei ief commands. The behaviour of the SIC outside of the ground stations' range can be evaluated from data stored on-board of the vehicle by a tape recorder.
4.
Excessive programming can be avoided by the introduction of some parameters which can be adjusted empirically during orbital operations.
Development and tests of AOOSY are sponsored by the German Ministry of Science and Education (BMWB).
INTRODUCTION
AOOSY allows within about one minute
3.
The development of AOOSY at Messerschmitt-Bblkow-Blohm GmbH will be completed until January 1970. It will be tested during the orbital operations of the German research satellite AZUR in 1970. Operational results will be available in March 1970.
By means of the high speed computation capability it is possible to evaluate all telemetry data acquired (technical information from scientific channels included), complete data evaluation and resulting failure allocation within fractions of a minute (remedial measures included) _ The monitoring of the satellite in positions which are not within the region of visibility of the ground stations will be accomplished semi-automatically by use of the on-board taped telemetry data.
260
The following advantages of AOOSY are apparent :
PRINCIPLE OF AOOSY
1. The complete and rapid data evaluation and the spontaneous command generation permit, in many cases, a reduction in the widespread and expensive net of "active" ground stations. Satellite monitoring and command transmission can be handled by a single ground station which has a high speed data channel to the control centre (and the AOOSY computer). (To acquire more real time data for scientific purposes it would be sufficient to have completely passive receiving stations which are automatic and unmanned.)
For the application of AOOSY it is required that a)
b) telecommands can be transmitted to the satellite during these contact times. The system still operates but with less efficiency when telecommands which have been deduced during one contact time can be transmitted during the next contact. In case of failure of the telecommand facilities AOOSY will still deliver spacecraft failure identification. '
2. The permanent data transmission lines between the control centre and the various active ground stations can be saved . 3. The personnel complement of active ground station can be saved. 4.
c)
In the control centre there will be a definite saving on personnel : a) The number of flight operations engineers can be greatly reduced. b) The engineers for monitoring the various active stations and the related data transmission facilities can be eliminated as well as the associated people and equipment for data preparation and display.
in case of spacecraft failures the satellite will survive during the interval between two contact times, since failure identification and correcting (emergency) commands can be derived only at the contact time following the spacecraft failure.
These three conditions are normal requirements for a spacecraft. They are also necessary for the conventional operations systems. (Standard ground station activities, such as demodulation of the rf signal, decommutation, command signal generation, etc. will not be considered here.)
5. The rapid and complete use of the complete telemetered technical information permits : a) rapid failure recognition and failure correction b) quick reaction to critical satellite conditions c) maximum mission completion through rapid flight operation handling and spontaneous failure correction. Time delays for human decisions, during which valuable date could be lost, will be avoided. d) Avoidance of human errors in decisions. (The preprogrammed automatic decisions of AOOSY contain the ~ide-ranging knowledge of the group which developed, Integrated and tested the satellite.) 6.
telemetered data can be acqu ired from the spacecraft during "contact times" between the satellite and the ground station to which AOOSY is linked . Contact times of less than one minute will be sufficient.
To demonstrate the principle of AOOSY, it has been assumed that two data down-links from the vehicle to the ground and one command up-link to the spacecraft exist. Further it has been assumed that data are encoded by time-multiplex PCM telemetry systems, which means that the different information channels of the spacecraft are sampled at regular time intervals, and the sampling results can be arranged in telemetry frames or formats. In one data down-link, the vehicle shall continuously transmit real time data which contain all technical information on the spacecraft (housekeeping values and scientific data)' The other data link may be used to transmit data which have been stored on board the spacecraft (playback of a tape recorder initiated by ground commands). Naturally, AOOSY could be similarly applied to other telemetry concepts.
Flight documentation and failure reporting are planned and standardized so that again less personnel is needed.
The continually transmitted real time data of the spacecraft will be utilized in the Real Time (Data) Orbital Operations System (RETOOSY) which is the most significant part of AOOSY . While R ETOOSY deals with the satellite's condition and perfo·rm ance at the moment of contact with the central ground station, the Taped Time (Data) Orbital Operations System (TATOOSY) treats satellite conditions which had occured recently. For this purpose all data which have been collected by the tape recorder on board the spacecraft are fed into the process computer during or after playback of the satellite's tape recorder.
7. The necessity for complete analysis of the mission, flight operations, and satellite relationships with normal and abnormal flight conditions "cross-fertilizes" the development of the spacecraft itself. 8. With one (relatively inexpensive) process computer more than one satellite can be monitored. 9. AOOSY is equally suited for monitoring space probes and in some cases also for rockets.
Technically significant channels of the TT data will be processed and plotted by TATOOSY. In this way satellite performance can be judged in those geograph ical positions of the spacecraft which cannot be "seen" from the central ground station. Thus T ATOOSY complements R ETOOSY and compensates for a net of distant ground stations. On the other hand, T ATOOSY is a much less important part of AOOSY because of the possibility of operating the satellite satisfactorily using RETOOSY alone.
10. This system is especially attractive for small countries, which still have not built their own ground station net or which, due to various reasons, will avoid building their own global net. Compared with these advantages the required expenditure for AOOSY is small. For the "hardware" items there are no additional costs, since the hardware for AOOSY is also necessary for the conventional "Quick Look" operation, and belongs to the normal ground equipment of a control centre and an active ground station. The "software" must be prepared anew for each satellite . However, in the development of each satellite very exact and wideranging functional and failure mode and effect analysis are made of the satellite systems and subsystems, on which the AOOSY programs can be based . The additional expenditure for the AOOSY software is still noticeable; however, it is small in comparison with the real saving.
Fig. 1 shows the block diagram of AOOSY logic. Rectangular blocks and solid lines signify automatic steps, elliptic blocks and dotted lines denote human activities. For the sake of brevity, only RETOOSY will be discussed. The first stage of R ETOOSY acquires actual technical data from the spacecraft ("actual frames" ), performs mission planning and command generation, calculates nominal technical data ("nominal
26 1
TA PED TIME (STORED ON
REAL TIME DATA
BOARD) DATA FROM
FR OM SPACEC RAFT
SPACECRAFT
COMMANDS TO SPACECRAFT
•••••• • ••• ••
••••••• •••••••••••••••••• DATA QUA LITY CHE CK
. • ••••••• ~
•• • •
· ·
I I
I
I
I I
•••
I
rI I
••••
I
I
I L_
---,
NOM INAL FRAME UPP ER LIMITS
I
•
I NOMINAL FRAME
I I
LOWER LI MITS
I
•
·•·
I
•
I • I
• • • ••
I
I
• • • • •• I • II
I I I I
I
I I I
/ /
L
I I I I
",
•
:
I
--U----J · :
RETOOSY
TATOOSY
•••••• • • • • • • • • • • • • • • • • • • • • • • • • • • • • 1 •• . . . . . . . . . . . .
AOOSY
CJ ---
c::> ---
fIG . 1:
AUTOMA T IC OPERA"I ION
HUMAN OPERAT ION
THE PRINCIPLE OF AOOSV
RETDOSY • REAL TIME I DATA I ORBITAL OPERATIONS SYSTE M T ATOOSY = TAPED TIME (OATA ) ORBI T AL OPERA TION S SYSTE:-.A
262
frames") and compares actual frames with nominal frames. As long as actual data are in accordance with nominal predicted values, the system stops"after having delivered a short printout as to spacecraft status.
periods could give more insight into the malfunctioning under consideration. This information is provided by TATOOSY. To establish the "nominal deviation frame" which belongs to a definite component or system failure, the effect of the failure has to be traced throughout the whole spacecraft. This is standard practice for failure mode and effect analysis which will be combined with the functional logic of the complete system. When all effects of a certain failure have been found, it can be associated with changes of the frame content, channel by channel. Depen· dencies of the nominal deviation frames on spacecraft operation mode can be eliminated by definite "blurring" or by introduction of multiple nominal deviation frames.
If actual data differ from nominal data, the difference will be stored within the "actual deviation frame" and failure allocation including first remedial actions will be initiated (second stage of R ETOOSY). The actual deviation frame will characterize the failure. Based on failure mode and effect analysis on the one hand, and on failure reports on the other, the effect of each possible failure on frame content has been considered during the preparation of orbital operations. In this way, a "nominal deviation frame" has been established for each failure. Com· parison of the actual deviation frame with all stored nominal deviation frames allows "(preliminary) failure identification".
It could occur that a possible spacecraft failure is forgotten during the preparation of orbital operations. In this case, no nominal deviation frame can be found which is comparable to the actual deviation frame. Now the computer will print the actual frame, the nominal frames and the actual deviation frame without starting fu rther action except to alarm control centre personnel. However, it seems rather improbable that many failures could be ignored during a carefu I preparation of orbital operations.
The programme system "mission profiles" allows a) prediction of contact times for all ground stations as well as other operational events, for instance shadow times, times in the radiation belt, etc. b) calculation of optimum mission course and necessary commands which must be transmitted to the spacecraft for optimum mission fulfilment, c) deduction of the operating condition of all satellite equipment (on, off, receipt of commands, switching of relays), etc., d) supply of input data for the adjoined programmes which predict performance and technical data for the spacecraft subsystems.
To make sure that failure identification has not been erroneous or to distinguish between failures which result in the same deviation frame, an appropriate test command will be initiated as the next step. Depending on spacecraft design, this will be useful only for a certain amount of all failures. The test command must lead to a definite predetermined actual deviation frame. If this frame has been found after command execution, the "final failure identifi· cation" has been achieved:
Besides technical characteristics of the satellite, mission require· ments and orbital elements which are constants of the pro· grammes, the only required inputs are mission data and mission condition (desired scientific or appl ication programme of the spacecraft).
After the final failure identification, the stored failure relief command will be delivered to the spacecraft. In relation to each failure, the optimum failure relief command was selected during the preparation of orbital operations. In many cases, no failure relief will be possible, in other cases, a perfect failure relief can be achieved by switching over to redundant systems.
Mission profiles and prediction programmes calculate off·line all "words" (1 bit, 6 bit, 12 bit, etc.) of the data frames which will be transmitted by the spacecraft during the coming passages. In cases where calculated results have large uncertainties (i .e. the difference between upper and lower limits becomes undesirably large), values which have been measured during the first orbits may be inserted into the nominal frames: flight results serve for correction of nominal frames by control centre personnel. Predicted data are arranged to form the upper and lower limit of the "nominal frame" which will be compared on·line with the "actual frame" dlJring the spacecraft's passage.
As long as no failures occur, it will be sufficient to have limited printout on spacecraft status (i.e. mission programme, battery charging, etc.). In case of failures, comprehensive standardized documentation will be initiated automatically and printouts of actual frame, nominal frames, actual deviation frame, failure identification and remedial actions will be delivered. Depending on the spacecraft, special documentation may be derived from RETOOSY stored data. Some data will be used to correct prediction programmes and to adjust the failure identification programmes for those cases where spacecraft will remain permanently in faulty condition.
Before comparison, the serial PCM RT·data of the spacecraft have to be controlled as to whether they meet the requirements for decommutation. If requirements are not met, the "data quality check" will initiate commands which will switch the satellite's (telecommunication and power) systems into possible back·up modes of operation. As soon as necessary data quality has been established, all RT data can be decommutated and stored as "actual frame".
FIRST APPLICATION MODEL R ETOOSY will be tested during the flight of the first German research satellite AZU R. For this purpose, commands will be derived automatically but they may be transmitted manually to the satellite. During final testing, RETOOSY will operate simul· taneously with the conventional Quick Look System. (TATOOSY will be realized to some extent by the so·called Quick Look C which serves for evaluation of taped time data.) In the following some notion of the development for this application will be given. Experimental results will be given during the oral presentation in March 1970.
Besides straightforward comparison of actual and nominal frames, some words of the actual frame are fed into small special "check·out programmes" which search for violation of forbidden values. These forbidden values would be significant symptoms for failures. The comparison of both frames delivers those words which are out of limit together with some indication as to which limits have been violated or which forbidden values have been found, respectively. All this information forms the content of the "actual deviation frame". The actual deviation frame will contain all telemetered information concerning a failure in the spacecraft. Only investigations on the satellite's behaviour during longer
The telemetry cycle time for complete build·up of one data frame is 10 sec. To prevent errors caused by spurious signals during data acquisition, RETOOSY will use two frames in case of failure recognition. Besides this basic double·cycle time which is deter· mined by the satellite's telemetry system, RETOOSY needs
263
100 msec to control all 130 different information channels (1 bit,6 bit, 12 bit and 24 bit) less than 3 sec to find the right one among 1000 to 2000 nominal deviation frames in case of a spacecraft failure.
All other programmes have been written directly in the assembler language PROSA. All programmes and data will be stored on the disk. After completion of the first stage of RETOOSY (comparison of actual and nominal data, 0.1 sec), the core memory will be loaded with programmes for the second stage (failure allocation) if the actual deviation frame does not disappear. By using an exchange buffer storage, all nominal deviation frames will be transferred from the external disk storage and can be compared with the actual deviation frame in less than two seconds.
For each telemetry cycle, the following values will be printed on the typewriter Printout Format 1 : a) number of data frame relative to commencement of contact with sa te 11 ite b) mission status (radiation belt, calibration programme, etc.) c) battery status (charge, discharge, trickle charge, on, off, critical, not critical, no statement) d) in case of failure: number(s) of nominal deviation frame, test command, relief command e) and only once per contact time the date, time, and the absolute number of the data frame derived from the satellite's clock.
CONCLUSIONS A system has been described wh ich allows automation of orbital spacecraft control with the aid of a process computer. It has been developed for tests during orbital operations of the German satellite AZUR. Similar systems could be applied to other satell ites and space probes.
If one of the temperature sensors indicates excessive temperature and/or if the spacecraft is in an unpredicted switching state, this will be shown by two additional print·out formats on the high speed printer. Print-out Format 2 will show which equipment violates temperature limits, and Print-out Format 3 will show the complete actual switching state inclusive of an indication as to which equipment should be "on" instead of "off" and vice versa.
ACKNOWLEDGEMENTS The development of the first application model of RETOOSY has been sponsored by the German Ministry of Science and Education (BMWB) represented by the Gesellschaft fur We:traumforschung (GfW), contract number RV 5-620/ 17/ 68.
For documentation purposes, the actual frame, the nominal frames and the actual deviation frame will be stored on tape whenever a failure has been indicated by RETOOSY. The Siemens process computer P 305 will be used for all calculations. Mission profiles and time-dependent nominal data will be calculated off-line several days in advance and stored on the disk. As the core mernory of the Siemens P 305 contains only 16 K words, many transfers will be necessary during these calculations, but establishment of nominal frames is fully automatized. The rather involved programme system for mission profiles and prediction of nominal data had originally been written in FORTRAN 63 for a CDC 3800 but then had been recoded into FORTRAN 300 which is accepted by the compiler of th is process computer.
KEY WORDS automatic control orbita I operations quick-look system spacecraft contro I
DISCUSSION
Q.
How many tel eme tric channels are attached and how many commands can it give? A.
:\ core rnern.ory is 16 K \\'ords, eaLh 1\'ord
~" Y"' ~! ~.~! 11 •
24 bits. Most o f the mel~r,n' i~ .',' ;: di,.;: 1","',' ,-, Ivhjch hils some mjlli0n \l'o I'd " , :'11c ,, ]).)1("], ,': ',"':"11'" is several hundred K \,·ords.
For the first Ferman spacecraft we have 130 different channels having information of one bit, six bits, twelve bits or even more and we have 70 commands available to arc on the spacecraft.
A.
Hm-e you iln\' results of tho sys t em?
Q.
Q. What are the technical characteristics of the memory devices and the reliability of the whole sYstem? What is the connection with the logic of the system?
OI'C ,' :'t I'.'I! :.,
~h
i.'
A. The ,;\'sterl i" nOl, under~oin" tcst '~ '·c, :·,ti,'n" \vith the ~pacecrilft. lIe mu~t adiCl,;t t:~c "1·.'c !:1'" "'ith some nh\',;ical \-alues like solar n;1(1.: le rerturbilti~n~. The I-ir"t result" "ho'., 0,' th ,t i, opeTil t es as the check.
This is basically a grOlmd system which means that reliahility problems are on an0ther level than the spAcecraft. \Ve are using a very small process computer having only a very small core memory of 16 K words but with a very large external memory on the gr0und. For all the calculations we make a lot of transfer between the core memory and the external memory. During the passage we operate with the nominal actual data in the small core memory. A.
264