Spacecraft Digital Attitude Control with Automatic Reconfiguration and Remote Programmability

Copyright © IFAC Theory and Application of Digital Control New Delhi, India 1982

SPACECRAFT DIGITAL ATTITUDE CONTROL WITH AUTOMATIC RECONFIGURATION AND REMOTE PROGRAMMABILITY S. Murugesan and V. K. Agrawal Control Systems Section, Isro Satellite Centre, Bangalore-560 058, India

Abstract. With the growing complexity and stringent requirements of spacecraft attitude control system, the use of microprocessor and other LSI circui ts is becoming more and more popular. It gives rise to a new discipline, namely, Programmable Digital Attitude Control and has advantages over the dedicated hardwired digital controllers. Various principles of "Automatic Functional Reconfiguration" of the system, to provide uninterrupted performance over a long period, are explained together with an example. Further, the concept of "Remote Programmability", which provides operational flexibility, by modifying the control algorithms/ laws from ground, to handle any unforseen requirements/problems developed onboard, is explained. Keywords. Aerospace Control; Attitude Control; Digital Control; Automatic Reconfiguration; Remote programming; Microprocessor. INTRODUCTION The progress in the field of attitude control of satellites has been very significantJmeeting the growing pointing and stability requirements. Neverthless, advanced space missions for direct TV broadcasting, multibeam space communication and high resolution remote sensing pose the challenging requirements of very high accuracy and stability, high reliability and uninterrupted operation over a period of lO to 15 years. Although hardwired and dedicated digital controllers overcome th~ performance limitations of analog controllers, they lack versatility and require a large number of ICs, with consequent increase in power consumption, weight, etc. But the advent of microprocessor, high density semiconductor memories and other LSI circuits have opened a new discipline in spacecraft control, namely, "Programmable Digital Attitude Control", which is versatile and capable of meeting the challenge of stringent performance specifications. The programmable digital controller in principle does the same functions as the analog controller, but error processing, compensation and other control algorithms are done digitally with increased accuracy and ability to retain previous values for subsequent calculations. Further, it is

programmable in nature and can carryout complex computation and decision making operations. It has the following advantages: i) Improved accuracy,precision and range, increased flexibil~ty and multimission adaptability by just changing the software/firmware, rather than complete redesign and requalification of the hardware. ii) Implementation of advanced strategies like attitude state estimation (Kalman filtering),adaptive and optimal control and automatic selection of different algorithms based on various failure modes of actuators and sensors. iii) Easy incorporation of fault tolerance, failsafe and self diagnostic features for better reliabili ty. iv) Remote programming provision to change or modify the control algorithms to handle unanticipated failures and unforseen requirements. Spacecraft Attitude and Orbit Control

681

682

S. Murugesan and V. K. Agrawal

System (AOCS) using microprocessor, and its various functions are discussed in detail. Principles of automatic functional reconfiguration of the system to provide uninterrupted performance, even after failure of some of the subassemblies, by masking the effects of failures, are discussed, with an example of four reaction wheel system. Finally, the concept of remote programmability, which gives operational flexibility to handle any unforeseen circumstances/requirements of the system, is described. ATTITUDE AND ORBIT CONTROL SYSTEM A block schematic of a typical Attitude and Orbit Control System (AOCS) is shown in Fig. 1. It consists of Attitude Control Electronics(ACE) and a variety of attitude sensors and actuators. The ACE receives input from various sensors and telecommand system and generates control signals for actuators, such as momentum wheel/reaction wheels, magnetic torquers and Reaction Control System (RCS), in accordance with the control algorithm, to provide attitude control despite the disturbances acting on the satellite (Fig. 2). The control electronics has to perform a variety of functions such as spin rate and spin axis orientation control (for spin stabilised spaceccrafts, and if required, for three axes stabilised spacecrafts during transfer orbit), sun and earth acquisition, on-orbit pitch, roll and yaw axes control using reaction wheels, back-up mode of control using magnetic torquers/thrusters(RCS) ,orbit manoeuvres (Station keeping), attitude estimation (Kalman filtering) to extract the signal from noisy sensor outputs,programmable biasing of the sensor output to compensate for seasonal variations and collection of house keeping information. Most of the above functions are carried out automatically in autonomous manner onboard the spacecraft. As the control system requirements become stringent, computational accuracy and requirements of the Attitude Control Electronics (ACE), the heart of the control -system, grow enormously necessitating microprocessor based system. In addition to easy implementation of fault tolerance and self diagnostic routines, it has an outstanding advantage of multimission adaptability. The same hardware can be used for a variety of spacecrafts by simply reprogramming the control memory to meet the new requirements. Use of Electrically Erasable Progra-

mmable Read Only Memory(EEPROM) for program storage, allows in-circuit modification of the program electrically without need for physical replacement. This feature reduces cost and the time required to produce proven and flight worthy hardware for various missions. AUTOMATIC FUNCTIONAL RECONFIGURATION Even if the spacecraft control system is designed for high reliability of operation, during its long mission life, failures or faults do occur in orbit, which if not corrected might cause a catastrophic ending of the mission. In the early missions, faults developed during flight was identified by the mission control centre in the ground, by analysing the housekeeping and other related information, and suitable actions were taken to overcome the effects of failures, usually by switching over to redundant system through ground commands. Considerable time, as high as few hours, is elapsed before corrective action is taken, especially for non-geostationary satellites as the spacecraft is not 'visible' always to receive the housekeeping information and to take further actions. But, large elapse time cannot be tolerated due to stability, operational,economical and other constraints for many space applications such as communication and military satellites, where momentary or prolonged loss of communication may be serious, sun synchronous remote sensing satellites where reacquisition is difficult and deep space missions where communication time is excessive for interactive ground control. Automatic functional reconfiguration involves detection and isolation of faulty element in real time and immediate substitution of the redundant element / and/or modification of the control algorithm, to mask the effects of the failures. Malfunction of sensors, control electronics and actuators leads to overall s y stem failure. Generally, the failures are classified as additive failures and substitutive failures. An "additive failure", (e.g., drift, graceful degradation etc.) adds to the output produced by an instrument/ system in the unfailed operation, whereas the "substitutive failures" sUbstitutes an incorrect output independent of the expected output (e . g., zero or maximum output situation). Modelling and analysis of various failure modes are essential to identify the faults.

Spacecraft Digital Attitude Control

The Failure Detection and Isolation (FDI) algorithm detects the failures and isolates the faulty elements. Its effectiveness is measured by how best it detects and correctly isolates (cover) a failure, before it can jeoparadise the mission. At the same time it must have very low probability of false alarm. Various FDI algorithms such as Reasonableness check, Mathematical Modelling and Parity check, can be used, depending upon the characteristics of the system and the type of failures likely to occur. The "Reasonableness Check" algorithm makes use of the certain common features about the subsystems. Every physical system has definite time constant, which decides the response/ rate of change of the state of the system. This response time is very large for the mechanical systems. Any sudden change of state, which is physically impossible is considered a failure. For example, if an attitude sensor output suddenly shows a large change in attitude error, it is a clear indication of sensor failure, as the spacecraft attitude cannot change abruptly. The concept of mathematical modelling of the system is also used and it is a systematic way of detecting faults. Each block of the attitude control system, controller, sensors, actuators, spacecraft dynamics etc., are mathematically modelled and simulated onboard, using hardware/software. Any significant deviation of the actual performance of the system from the simulated model performance (called expected performance), gives an indication of failure. The success of the algorithm depends upon how accurately the system is simulated. Although the principle of mathematical modelling seems to be simple it is difficult to simulate complex systems onboard the spacecraft.

683

the fault or reconfiguration of the system. There are various ways of reconfigur!;nq the system to mask the effects of faults, depending upon the types of redundancy provided in the system. They are; i) Redundant system technique, ii) Alternate concept technique and iii) Redundant component configuration technique. Redundant System Technique In case of 'Redundant System' technique, two or more identical systems are used and when the fault is observed in one of the system the entire control is transferred to the other system to mask the fault. Although reconfiguration is simple and easy, it is not optimal and requires more power, weight and volume. The most severe drawback is that the conceptual faults cannot be masked. Alternate Concept Technigue Here, the system is designed to carryout the same task in two or more different ways, one is backup to other. The back-up component may be used for performing some other function, but in an eventuality it can be reconfigured to carryout the failed function. For example, attitude control of spacecrafts may be performed using different types of actuators, say, Reaction Wheels, Magnetic torquers and Reaction Control System. Normally, reaction wheel system is active and the torquers do the momentum dumping operation. In case of failure of reaction wheel system, the controller can be reconfigured to use the magnetic torquer for attitude control. Use of redundant control algorithm/software masks the software bugs in the controller. Redundant Component Configuration

Another method of FDI, 'Parity Check' is based on the principle that the same information is derived from more than one source, using independent algorithm. They are compared and disimilarity in the outputs indicates the failure. Normally, substitutive failures, which causes abrupt change in the output, are detected by "Reasonableness check", whereas additive failures are detected by using mathematical model and "Parity check" algorithms.

It consists of providing bare minimum redundancy to the number of identical components used in the system to carryout the similar task either individually or collectively. Faults in any of the components is masked by modifying the control laws to use the redundancy provided. It is most suitable for control actuators and has less overhead on weight, power and cost.

As an example, re configuration of "four reaction wheel system", using Once the fault is detected, the faulty Mathematical modelling for Fault component is isolated. Then the Detection and isolation (FDI) and important task is to mask the effects of Redundant Component Configuration,

s.

684

Murugesan and V. K. Agrawal

is described below. Automatic Reconfiguration of Reaction Wheel System

Four

For three axis stabilisation of spacecrafts three main reaction wheels, WP ' WR and Wy are mounted in an orthoganal triad along pitch, roll and yaw axes respectively, and the skewed reaction wheel, W ' which provides redundancy to all S the three main wheels, makes an angle a (=35.3 0 ) with all the three axes(Fig. 3). The torque generated by the skewed wheel has a component of 1/13 times its generated torque, along the three orthoganal axes. In case of failure of one of the main reaction wheels, the skewed wheel can be used, with appropriate modification in the controllers' input. Reaction wheel failures cause reduced rate of change of wheel speed/reaction torque and hence the same is taken as basis for failure detection. The control signal to each wheel is used to compute the expected wheel speed using the mathematical model. The actual and expected wheel speeds are periodically ~led at an interval of T and their values be Na(X) and Ne(X) s respectively at the X sample. The speeds at the previous th five samples are also stored for subsequent calculation. Let, The change in the X actual wheel speed X at the X sample, X th lINa (X) • X

X X

X X

TABLE 1

RECONFIGURATION OF THE INPUT AS A FUNCTION OF FAILED WHEELS

Input of the controller for the

No Wp fai- failure led

WR failed

W

tAiled

Pitch Wheel Wp •

e

*

e-~

8-~

Roll Wheel, W R

~

~-8

*

~-1/J

Yaw Wheel, Wy

~

~-e

1/J-~

*

Skewed wheel Ws

*

/38

/3~

13~

*Indicates corresponding wheels are off. Thus, the extra skewed provides redundancy to three main wheels and, failure, the system is reconfigured.

wheel, WS ' all the in case of automatically

REMOTE PROGRAMMABILITY Na (x) -Na (x-5) (1)

The change in the expected wheel speed at the X th sample liNe (x)

generates the same amount of undesired torque along roll and yaw axes. To compensate for this, p-e and ~-9 are used as input to the roll and yaw controllers (see also Table 1).

Ne(x)-Ne(x-5)

(2)

If the actual change in wheel speed differs from the expected by more than a given threshold, K(i.e., if 11INa(x)-lINe(x) I>K), for atleast three consecutive samples then that wheel is considered to be faulty and it is switched off, and automatically the skewed redundant wheel is made ON. This algorithm has fast response and low probability of false alarm. Normally, when there is no failures, the main reaction wheels, Wp'W and R Wy will be operating with pitch,roll and yaw errors, e,~ and ~ as input to the respective controllers. In case of failure of the pitch wheel, W ' the skewed wheel, WS ' will be made P ON, with 13 times the pitch error as input to its controller. While generating the required torque along the pitch axis, the skewed wheel also

It is not possible to anticipate and plan for all the control system problems that might occur in several years life time of a typical large and complex spacecraft. Many spacecrafts have developed unusual and unexpected problems and multimode failures in orbit. Further, system dynamics of spacecrafts with large flexible appendages (solar arrays, antenna etc.) cannot be reliabily tested at ground and there is some uncertainity which cannot be removed before 'on-orbit operation'. These tendencies are bound to grow as spacecrafts become more complex and are planned for 10-15 years of onorbit operation. To successfully manage the above situation and provide acceptable level of control system performance the concept of "Remote Programmability", which is easily feasible with the use of microprocessor, is becoming popular. Depending upon the type of failures, which are detected and analysed in ground, alternate manoeuvre and control laws can be devised and transmitted to attitude control system through the telecommand. The on-board

685

Spacecraft Digital Attitude Control

processor's Direct Memory Access(DMA) capability or standard operating software dedicated to the particular processor is made use of, to store the new software/algorithm in the ElectricallyErasable PROM (EEPROM). The controller executes the new algorithm under the command control. For example, in case of failure or excessive drift in yaw sensor (gyro) used for yaw axis control of three axes stabilised satellite using reaction wheels, the mission can be saved by using one reaction wheel as momentum wheel to provide control about the pitch axis and thrusters/ magnetic torquers to provide control about the roll axis. Because of the gyroscopic stiffness of the momentum wheel configuration, yaw error build up is very slow and it automatically gets corrected as the yaw error becomes roll after quarter orbit. Hence, separate yaw error sensing is not required. This requires complete redefinition of controller and its algorithm and the same can be implemented through remote programming. Also, parameters/controller gains can be modified to confirm to actual conditions that exist on-orbit, thereby improving the normal performance. This feature can also compensate for wrong polarity due to crossed wires, etc., which would have become detrimental to the mission.

operating software makes the processor to sequentially store the incoming data, corresponding to the new program, in the Electrically Erasable PROM (EEPROM). Similarly, by passing another code word and program starting address, the processor starts executing either the newly loaded or even the old program. Provision also exists to read the lnemory contents. Thus, by designing a system with remote programmable feature, acceptable level of the system performance can be obtained despite the malfunction, unusual failures and unforeseen requirements. CONCLUSION It is seen that digital attitude control using microprocessor is very versatile and meets stringent performance specification imposed on it. Automatic reconfiguration of the system gives an ultra reliable system with minimum redundant components. Remote programmability provision makes the system adaptable to any unexpected requirements and hence enhances the probability of success of the mission. ACKNOWLEDGEMENT

Block schematic of a typical remote programmable Attitude Control System is given in Fig. 4. The microprocessor carries out the normal functions according to the program/algorithm stored in the PROMs. On detection of the faults, the processor is commanded to execute the operating software stored in an another PROM. This allows the nrocessor to communicate with' the TelemetryTelecommand (TTC) subsystem on serial data link. By sending a proper code word, and startin~ address of the memory, the

The authors thank Prof. U.R. Rao, Director, ISRO Satellite Centre, Mr.R.M.Vasagam, Head, AOCS Division and Mr.P.S. Goel, Head, Control Systems Section for their encouragement and guidance during the course of this work.

NO ' SE ; DIST UR6ANCE S

I

- t"" , ,-

I

~

SENSQ<1S

--"

I

CONT ROL

(Contro l

ELECTR ONICS

law, a100n thms

,I

~l l

I: """

computation etc.>

I,

"

I";

11 " 11

:I ,'

TORQUES ,--_ _--L-_ _--,

L~ =:_~:: =:-:_-.:_-_-_-

FIG.l.

:: "

-:::= -:.:.. ::==-=-=-=-:::.::=. =__-..= =:::=:~

BLOCK DIAGRAM OF TYPICAL ATTITUDE AND ORBIT CONTROL SYSTEM.

S. Murugesan and V. K. Agrawal

686

r

\

SENSORS

POWER

I

ATTITUDE CONTROL

I 1

-:

TELEIIETRY

I

ELECTRONICS (CONTROL ALQOAIT_1

-I

I

MOfooIEIIfT\JIIII REACTIOII

r

WHEEI..S

MAGNETIC TOfI~

\mECOMUANJ :

1

I

COffTi

IR£ACTlON -ROL IYSTOl

FIG. 2. WTERFACE DETAILS OF ACE

PROM

MEMORl'- l

NORMAL

INr£RF~~0---- -

-

SOFTWARE ME'" ADDS AND CONTROL BUS

PI TCH A )(IS

SKEWED WHEE L

Wp

/

AXIS

§2)ws _ _ .G - R O L L A XIS WR

VAW AXI S

FIG. 3 RECONFIGURABLE REACTION WHEEL SYSTEM

ATTITUDE

SENSOR

CONTROL ACTUATOR INTERFACE

AND OTHER SUBSVSTE

FIG. 4 . BLOCK SCHEMATIC OF A TYPICAL REMOTE PROGRAMMABLE

SYSTEM