[American Institute of Aeronautics and Astronautics SpaceOps 2006 Conference - Rome, Italy ()]...

1 American Institute of Aeronautics and Astronautics

Planetary Orbit Insertion – A First Success for Europe with ESA’s Mars Express (Tracking Number: 55798)

Jörg Fischer1, Zeina Mounzer2

VEGA

Michel Denis3, Alan Moorhouse4

European Space Agency (ESA)

The 25th of December 2003 will always be remembered as one of the special days for the European Space Agency (ESA). When precisely at the predicted time the spacecraft Mars Express emerged from behind the

planet Mars, after a 40 minute burn of its main engine, and the first signal was received by the ground station, it became clear that one of the most ambitious challenges undertaken by the European Space

Agency so far was a great success: The safe insertion of a spacecraft into Mars orbit. It was a challenge in many aspects. Mars Express presents the first of a new generation of science missions, known as flexi

missions, built and launched in record time with a minimum cost. It is a double mission having an orbiter and a lander, where the lander is ejected to its targeted site with high precision only a few days prior to inserting the orbiter into a Mars bound orbit. This paper will elaborate on the organization and efforts that had to be made to achieve the goal, coping with the specific challenges of the Mars Express Mission

and show why the Mars Orbit Insertion phase was so critical and exciting from the perspective of the Mars Express Flight Control Team.

Nomenclature AOCS = Attitude and Orbit Control System ASPERA = Analyzer of Space Plasma and Energetic Atoms ESA = European Space Agency ESOC = European Space Operations Centre FDIR = Failure Detection Isolation and Recovery HRSC = High Resolution Stereo Camera LEOP = Launch and Early Orbit Phase SVT = System Validation Test MaRS = Mars Radio Science MARSIS = Mars Advanced Radar for Subsurface and Ionosphere Sounding MEBM = Main Engine Boost Mode MEX = Mars Express MOI = Mars Orbit Insertion MTL = Mission Timeline OMEGA = Observatoire pour la Mineralogie, l’Eau, les Glaces et l’ Activite PFS = Planetary Fourier Spectrometer RCS = Reaction Control System SAM = Sun Acquisition Mode SPICAM = Spectroscopy for Investigation of Characteristics of Mars SSMM = Solid State Mass Memory TCM = Trajectory Change Manoeuvre

1 MEX Spacecraft Operations Engineer, Operations Department, European Space Operations Centre, Robert-Bosch-Str.5, 64293 Darmstadt, Germany, [email protected] 2 MEX Spacecraft Operations Engineer, Operations Department, European Space Operations Centre, Robert-Bosch-Str.5, 64293 Darmstadt, Germany, [email protected] 3 MEX Spacecraft Operations Manager, Operations Department, European Space Operations Centre, Robert-Bosch-Str.5, 64293 Darmstadt, Germany, [email protected] 4 MEX Deputy Spacecraft Operations Manager, Operations Department, European Space Operations Centre, Robert-Bosch-Str.5, 64293 Darmstadt, Germany, [email protected]

SpaceOps 2006 Conference AIAA 2006-5861

Copyright © 2006 by European Space Agency, VEGA Group PLC. Published by the American Institute of Aeronautics and Astronautics, Inc., with permission.


I. Introduction

Looking at the history of attempts to orbit or land on the planet Mars, this is not an easy task. Out of the 42 missions sent out to the red planet, only 19 were successful. Out of those 19 missions 4 were flybys and 9 were Landers, which leaves only 6 successful Mars Orbit Insertions. This shows how difficult it is to navigate a spacecraft over a distance of up to 400.000.000 km to a target planet in a safe and efficient way. Not only the final act of orbit insertion is important, it is the achievement of a long process from manufacturing of the spacecraft, team building, preparation of the ground segment and operations procedures, simulations, launch of the spacecraft, precise navigation and overcoming any obstacles and problems until the planet is in view. This requires a multi-team effort from various parties involved. Two and a half years in orbit around Mars for the first European planetary mission Mars Express allows a look back to reflect on what we have achieved. After the excitement of the launch, the unexpected high workload during the 7 months cruise phase, followed by the Beagle-2 release and Mars Orbit Insertion, flying Mars Express in still a challenge in many aspects but thrilling and very rewarding to us, the Flight Control Team.

The Planet Mars has always been a subject of curiosity, anxiety, fascination and scientific interest amongst various different cultures and societies around the world. For decades the success and disaster of missions to Mars were the privilege of the two great powers on Earth, the United States of America and the former Soviet Union. No less than 42 missions were sent out to the Red Planet, yet only a small fraction succeeded. When in 1968 the Europeans entered the arena with their own Space Agency ESA, we were a long way away from missions to Mars and it wasn’t until 2003 that we finally pulled level with the leading countries. On December 25th of that year the European Space Agency succeeded on its very first attempt to put a spacecraft into orbit around Mars; a great success for ESA.

This is the story of the Mars Orbit Insertion as seen and experienced by the Mars Express Flight Control Team, consisting of various groups within a multinational crew that became a real “TEAM”.

II. The Planned Mission Objectives The primary mission objective was to safely get the spacecraft to Mars, release a Lander, and insert the spacecraft into

Mars orbit, followed by an intense science campaign for at least one Martian year (about two Earth years). The objective of the science instruments on the orbiter is to obtain/measure:

• Global high-resolution photo geology (incl. Topography, morphology, paleoclimatology, etc.) at 10 m resolution

(HRSC) • Global spatial high-resolution mineralogical mapping of the surface at 100 m resolution (OMEGA) • Global atmospheric circulation and high-resolution mapping of atmospheric composition (PFS) • Subsurface structure at km scale down to permafrost (MARSIS) • Surface atmosphere interactions (ASPERA) • Interactions of atmosphere with interplanetary medium (SPICAM) • Radio Science (MaRS)

The mission plan from launch until Mars Insertion is shown in Figure 1.

Figure 1 Original Mission Layout (Credit: Astrium)

It comprised the following phases: • Launch and Early Operations Phase (2 Jun – 7 Jun 2003) • Near Earth Commissioning phase (7 Jun – 14 Jul 2003). • Cruise phase (14 July – 15 Dec 2003) • MOI phase (B2 ejection) till 25 Dec 2003

The Cruise Phase was intended to be a quiet period with merely two trajectory correction manoeuvres, a solar opposition (Sun-Earth-S/C alignment), a software upgrade to the Attitude and Orbit Control System (AOCS) to allow use of the Main Engine in parallel with the 8 thrusters, and the Main Engine priming and test. The MOI phase included a dense sequence of mission critical activities:

• Arrival-9 days: fine targeting manoeuvre for Beagle-2 ballistic delivery. • Arrival-7 days: Beagle-2 preparation start. • Arrival-6 days: Beagle-2 ejection. • Arrival-5 days: Mars Express retarget to capture point. • Arrival-2 days: Mars Express fine tuning manoeuvre. • Arrival - 1 day: Mars Express Fail Ops configuration for Injection.


• Christmas day: Arrival and Capture by Mars.

III. The Mars Orbit Insertion Mars Orbit Insertion (MOI) identifies the insertion of an object into a stable orbit around Mars. Being 150.000.000 Km

away from your target and you having to enter the Mars orbit through a window of 100 km size shows how accurate the navigation has to be. This is only a one-shot opportunity, if missed, the spacecraft would either crash on the planet or fly past it, disappearing into deep space.

The Mars Orbit Insertion is not a single task that has to be performed; it is a whole phase with a series of activities that have to be planned months in advance. From the earliest stage, all phases of the mission design are driven by the need to capture around a target planet. In the case of Mars Express the late adding of a Lander (Beagle-2) to the mission concept had an additional impact on the mission design. It was following a different concept to previous American or Russian missions, where a spacecraft either delivered a Lander or was put into orbit, or in the case of Viking, delivered a Lander that has its own propulsion system, from a stable Mars bound orbit.

Instead, Mars Express was to deliver a Lander prior to capture and go into orbit afterwards. As the Lander did not have a propulsion system of its own, the orbiter was used as a targeting device: Mars Express was put on a collision course with Mars, aiming at a specific landing site for the Beagle-2. After ejection, Beagle-2 would follow a ballistic trajectory to the landing site while the orbiter would then perform a re-targeting manoeuvre away from the collision course to its own target insertion point. This then would be followed by the actual orbit insertion; a large manoeuvre (~800 m/s) around the pericentre of the incoming hyperbola to Mars, which reduces the velocity of the spacecraft such that the resulting orbit is Mars bound.

The internal design of the Lander allowed a lead programming time of the descent and landing mechanism of about 6 days, and its batteries could only provide power for that amount of time. So the fine targeting before ejection, the ejection itself, the retargeting of the spacecraft, a possible fine tuning manoeuvre and the Mars orbit insertion had to be performed within 9 days before arrival. This special design explains why the whole phase of the Beagle-2 release and Mars orbit insertion was very intense and challenging. This did not allow much time for recovering possible on-ground or on-board failures. A very strict timeline was laid out that provided for certain margins, but set definite deadlines for certain activities. Figure 2 shows the phase in graphical form, including the margins available for recovery of potential failures.

Figure 2 Mars Express Final Approach

This phase had a heavy impact on the design of the spacecraft. Three vital parts to the mission had to be implemented:

• A high degree of on-board autonomy, allowing the spacecraft to operate for extended periods virtually by itself, and to be able to resolve a certain number of contingencies without ground intervention.

• An on-board mission timeline function (MTL), allowing the upload of time-tagged commands as long in advance of their execution time as necessary.

• A special Reaction Control Subsystem (RCS), including a 400 N main engine to actually perform the capture, with built-in backup strategies.


IV. The spacecraft The Mars Express spacecraft is the first of a series of Flexi-Mission spacecraft, built in very short time, hence the name of

Mars Express, with a limited budget (compared to previous missions) and a small team to operate it from ESA’s operation centre ESOC (European Space Operation Centre) in Darmstadt, Germany. The spacecraft was built by a consortium of European companies lead by Astrium France as prime contractor.

Mars Express is the lowest cost interplanetary mission so far and a pioneer for new methods of funding and working. It is providing a wealth of information, experience and innovations for future missions.

The cost of the satellite, including the launch and all operations, amounts to about € 230 Mill., about half of the cost of a “cornerstone” mission. The Lander Beagle-2 and the instruments were funded independently.

The selection of a Soyuz/Fregat Launcher was also linked to the flexible approach adopted by ESA. The launcher was procured by STARSEM, a Russian/European company. As a relatively low cost, but extremely reliable launcher it helped keeping the overall cost of the mission within the total budget.

The mission requirements, science return and system concept drove the spacecraft design, inheriting several of the Rosetta spacecraft design elements, mainly in the avionics area. It features a concept with body-mounted payload of seven state-of-the-art scientific instruments, one Lander (Beagle-2) and its data relay system, fixed high gain antenna and one degree of freedom steerable solar arrays. Figure 3 shows the structural set-up of Mars Express.

The instruments have different pointing and operations time-line requirements. Common is the requirement of nadir pointing at low altitudes, both during good surface illumination for the optical instrument, and during night for the radar. The instruments also require observation times at higher altitudes for surveys.

Figure 3 MEX Spacecraft view (Credit: Astrium)


The spacecraft subsystem for the Mars Orbit Insertion manoeuvre is the RCS subsystem (Reaction Control Subsystem). As most of the velocity required for the journey to Mars was provided by the Soyuz/Fregat system, the spacecraft uses its own propulsion system only for trajectory correction manoeuvres, the actual Mars Orbit insertion, orbital maintenance and wheel offloading. The 400 N main engine and the 2x4 10 N thrusters use a bi-propellant system. The fuel is fed into the engine and thrusters using pressurized helium. The main engine is to provide enough thrust for the insertion of the satellite into Mars orbit and for the subsequent apogee reduction manoeuvres. During the initial cruise phase, the 10 Newton thrusters performed all correction manoeuvres. In fact, the main engine was isolated from the fuel, oxidizer and pressurant tanks by special valves for the whole cruise. The priming of the engine (opening of the valves) and a very small test manoeuvre were performed at the end of the cruise phase with the main engine:

• To verify the engine was functioning; • To analyse the torques induced by the firing, so to better prepare for the orbit insertion; • To confirm in-flight the robustness of the Main Engine Boost Mode (MEBM); • Verify the dynamics transition after the burn through Sun Acquisition Mode (SAM).

Figure 4 shows the layout of the Mars Express RCS subsystem

Figure 4 Mars Express Propulsion Schematic


V. The Operations Operations for Mars Express are carried out from ESA’s Operation Centre ESOC. Here a multi-national team of engineers

starts building-up about 3 to 4 years before launch, preparing the ground segment and the operational procedures for the whole mission. Figure 5 shows the Main Control Room at ESOC.

Figure 5 Main Control Room at ESOC

VI. The Mission Preparation In the years preceding the launch of a spacecraft numerous teams of experts distributed over the contributing companies

and organisations are preparing the space and ground segments. Each of these teams is focusing on the area of its responsibility and is interfacing as required. A major additional requirement is raised for the Launch and Early Orbit Phase (LEOP) and all critical operational phases: interfacing is not enough, integrating the teams into one Mission Control Team is a must. All the different experts shall work together in an operational environment and the interaction and interfaces between all elements of the system (software, hardware and human) have to run smoothly for this to happen :

• The flight operations procedures have to be written and validated down to the smallest detail; • The control system has to be validated; • System Validation Tests (SVTs) with the satellite must be performed to demonstrate the correct interfacing of the

ground and space segments; • Mission Readiness Test with the Ground Stations have to be performed; • A Simulations Campaign is run.

7

American Institute of Aeronautics and Astronautics

VII. The Simulations A high profile simulations campaign is performed, training the Mission Control Team to be able to deal with every

possible scenario that might be encountered during flight. The simulations campaign is a programme during which an effective structure of all elements is developed and maintained, and where the main focus is the build-up of the Mission Control Team comprising all experts involved in the operations of the spacecraft. In the case of Mars Express actually two simulation campaigns were run:

• The first for the operations after launch (LEOP); • The second for the phase of Beagle-2 release and Mars Orbit Insertion. This second Simulations campaign was

performed during the cruise towards Mars.

Creating a coherent team structure is essential in ensuring mission success. This translates to efficient interaction and coordination, accurate analysis and troubleshooting, leadership, decision-making and precision in carrying out operational tasks; all under stressful circumstances and usually under time pressure. The primary goal of the simulations campaign is the development of such a team structure and training them in all of the above skills.

VIII. The Team The Mission Control Team is comprised of the Flight Control Team, Flight Dynamics Team, Ground Operations

Managers, Software Support and Ground Facilities Engineers, who are located at ESOC, as well as external teams like the Project and Industry Support teams, who have designed and built the spacecraft. This paper focuses on The Flight Control Team.

The Flight Control Team consisted of:

• The Ground Segment Manager • The Spacecraft Operations Manager • Eight Operations Engineers • Two Mission Planners • Two Spacecraft Analysts • Four Spacecraft controllers

The team build-up started about 4 years before launch, a task for the Spacecraft Operations Manager. He has to find suitable engineers for all the different tasks and form a team out of them. The word “Team” cannot be stressed enough when it comes to spacecraft operations. Only when the team functions correctly as a whole, can success be achieved. For Mars Express, the engineers came from various other missions, mainly Earth orbiting satellites. Different personalities, ages, cultural backgrounds and characters had to be integrated. The dedication of the Mars Express team to overcome problems in a very flexible way and their willingness to accept a lot of personal sacrifices and work for a common goal made the success possible.


IX. LEOP and Cruise At launch everybody on the team was tense. After a long and tiring preparation phase the nervousness was felt. The Flight

Control Team was not yet in control. Waiting for the launch success is a necessary but painful experience for all spacecraft operations engineers. Media coverage was very high that day, adding to the tense atmosphere. On 2nd of June 2003 at 17:45 we saw a perfect launch, and 95 minutes later the Fregat upper stage released Mars Express at precisely the right time and with the correct escape velocity. We were on our way to Mars.

Figure 6 Soyuz Lift Off

The plan foresaw a period of about six weeks after launch for testing the spacecraft in flight and commissioning of the instruments, followed by a “quiet flight phase” during the five months Cruise Phase, which would allow time to prepare for the Mars Orbit Insertion. It soon became obvious that this ”cruise” would be indeed very busy. The following provides an overview of the encountered problems that added to the workload of the Flight Control Team in their efforts to fly the spacecraft and in parallel prepare for the Mars Arrival phase.

X. The Sun affects the Star Trackers A few hours after separation it was recognised that Sun stray-light close to the field of view of both star trackers

prevented the acquisition of stars. The thrusters were still achieving the attitude control at this point and the nominal sequence required the input of the star trackers in order to make the transition to reaction wheel control. This triggered an intense phase of troubleshooting and simulation to find a way to achieve the normal mode pointing (high gain antenna pointing towards Earth) without the star trackers before the spacecraft was out of range of the omni-directional Low Gain Antennas.

Three lines of actions were running in parallel: • Identify a way to go from thruster control to reaction wheel control without the star trackers’ output in the loop and

test this on the simulator.


• Identify potential regions of the sky where the effect of the stray-light would no longer obstruct the acquisition of stars. This was achieved by analysis and subsequent slews in small intervals.


• Develop and test a patch for the star tracker software that decreases their sensitivity to bright objects.

Within one day the required FDIR (Failure Detection Isolation and Recovery) modifications, to allow a transition to reaction wheel control without the star tracker’s output, were tested on the simulator and implemented on the spacecraft. This was followed by a series of slews resulting in identifying regions of the sky that would allow correct acquisition of stars, and the relevant spacecraft attitudes. In parallel, the industry support team had developed the required software patch. The development of this patch – later nicknamed ‘the sunglasses patch’ – its testing on the simulator and its in-flight testing on the redundant star tracker, was achieved within two and a half days.

XI. The Power Limitation While specific slews to areas of the sky away from the Sun direction were performed in order to confirm the star tracker’s

health, a severe problem in the power subsystem was found. A wrong connection in the wiring of the solar panels to the power system meant that at maximum only 72% of the power produced by the arrays was usable by the power system. A solar array characterization was performed. With the initial settings of the power regulators designed to cope with still relatively high temperatures of the solar arrays, only 51% of the originally expected value was actually available.

Calculations showed that even with this limitation the mission objectives were not endangered. However, the impact on operations had to be fed back into the selection process for the final target orbit around Mars. With the reduced power margin the amount of power needed for the operations and execution of science plans needed to be carefully analysed. This triggered an intense dialogue between the scientists, operations, the project and industry, where various optional target orbits and optimisation strategies were discussed and analysed.

The analysis on the impact of the reduced power and in-flight testing was conducted throughout cruise. This resulted in an optimal configuration of the power system such that the effective power extracted from the solar arrays was close to the theoretical limit of 72%, a heating strategy minimizing the needed power for thermal control, and possibly an optimisation of the target orbit. The final GO for the target orbit, preferred by the science team and demonstrated to be safe for the spacecraft, was only given in early December 2003.

XII. The Star Trackers and the MOI Sky The stray-light patch was functioning well but it led to lower acquisition probability in case the star tracker lost tracking,

for instance during wheel off-loading. It was also predicted that the redundant star tracker would not acquire from the 25th of November 2003 up to the time of the MOI because of Mars in its field of view.

To further test the performance of the star trackers, a special slew was performed that covered the star regions in the field of view at the time of MOI. The test performed during summer 2003 showed that due to the poor on-board star catalogue with respect to the sky conditions, the prime star tracker would not reacquire in Earth pointing attitude from the 14th to the 16th of December, if tracking were lost.

To mitigate the risk, two complementary strategies were developed: • To ensure survival with insufficient sky in the period prior to MOI, regular attitude slews to a region with good star

coverage were planned to obtain star tracker measurements, as an option twice a day into the already loaded pre-arrival timeline.

• Plans were laid out to be able to run without star trackers. Instead, the high gain antenna offset and a fake gyro drift could be used to maintain Earth contact.

XIII. Pros/Cons of Advanced Autonomy Another effect of deep space operations was slowly having an impact. With increasing distance from Earth, the time the

signal needed to get from the ground station to the spacecraft and back became longer and longer. Although this signal travels at light speed, by the time we got close to Mars the signal roundtrip time had increased to 16 minutes. With such delays, real time operations cannot be performed any more.

Additionally, communications with the spacecraft are not possible at all times, depending on ground station availability. Typically, ground contact with the spacecraft was maintained during an average of 12 hours a day. During periods of solar conjunction, which happens when at Mars, an outage of several days had to be taken into account. Therefore, the satellite had to be able to take care of itself.


A highly advanced on-board autonomy had been built in the Mars Express design. A sophisticated error detection mechanism monitors all subsystems, ready to react if problems arise. Although mandatory to survival of a complex spacecraft, the side-effects of this system were painfully noted several times when the satellite went into a so-called Safe Mode after problems had been detected by the on-board autonomy, in particular:

• Problems with the Solid State Mass Memory (SSMM) resulting in a transition to Safe Mode for reasons that were

not fully explained at the time (September 2003). To avoid that this happens in the few hours around MOI, it was consequently decided to modify the operational configuration for capture and switch OFF the SSMM completely during MOI. Thus, the baseline had to be abandoned, where the SSMM was to be used as recording device for acquiring data from a unique event and accurately tracking the fuel consumption.

• A spacecraft reconfiguration after a problem with the Remote Terminal Unit (RTU). Since the RTU is a vital unit permanently in use, no practical consequence could be drawn for the spacecraft configuration during MOI.

A learning process had to be adopted to fully understand and bring the on-board software inline with operational

requirements. Thanks to industry support most of these problems could be captured, analysed and solved through up linking of software patches or configuration changes to minimize the undesired effects of autonomy in critical phases like MOI, while keeping the spacecraft safe at all times. This learning process was of significant benefit to the Flight Control Team but significantly increased the stress level and the workload, which had been assumed to be dedicated to MOI preparation “as per the book”.

XIV. The Solar Flare On the 28th of October, just as most spacecraft issues seemed to have settled, Mars Express, together with a large number

of other satellites, was hit by one of the largest Solar Flares ever recorded. The whole spacecraft behaved well despite the large error counts, with one exception:

The star trackers were both blind for 30 hours. It took 72 hours until star acquisition was 100% restored. If a Safe Mode had been triggered during the 30-hour blinding period, the recovery would have been complex and labour-intensive. At this stage – seven weeks prior to capture – this would have had a significant impact on the ongoing preparations for MOI. In order to mitigate the risk of such hazard, which would have had even larger impacts the closer Mars Express approached the date of capture, new timeouts for the star acquisition process in the star trackers and AOCS software were uplinked. As a further effect of the flare, solar array degradation was estimated at 1 to 2%.

XV. The Manoeuvres During the cruise, three trajectory correction manoeuvres were executed to put the spacecraft close to, then directly on,

the Mars collision course 50 days before arrival. This could be done thanks to the high precision navigation performed by Flight Dynamics and with the help of Doppler and Delta Differential One-way Ranging (DDOR) campaigns, triangulating the position of Mars Express with high accuracy, using NASA Ground Stations. The data was collected and analysed by ESA/ESOC and the necessary correction manoeuvres planned and executed.

XVI. The MOI Simulations Three months before the arrival the second simulations campaign started in preparation for the MOI phase. The team had

to perform 10 hours of simulation twice a week in parallel to flying the spacecraft The team was divided in two: while one half of the team was training, the other half was flying the spacecraft and dealing

with the running problems. These roles were reversed each week. Both teams were involved in modifying and testing of procedures. In one case, shortly before a simulation briefing, Mars Express had again entered safe mode. The decision was taken not to lose the valuable simulation training, leaving the on-duty half of the team to recover the spacecraft, which went flawlessly.

Several elements distinguished the Mars Express post-launch simulations campaign from the ‘traditional’ pre-launch simulations campaigns.

The Mission Control Team was the same team that had gone through the pre-launch training within the same year and had been already working together for several months on operating the mission. They were already a cohesive unit and had gained a lot of in-flight experience and knowledge of the spacecraft.


The Near-Earth Verification and Cruise phases revealed some problems on the spacecraft and the team had a heavy schedule with daily operations while resolving the problems at hand. In addition, the timelines and procedures for the MOI phase had still to be defined, created and verified. The team had to go through the simulations campaign while flying the real spacecraft and performing the activities on their daily schedule.

The One Way Light Time was increasing and was going to be around eight minutes during the MOI phase – a value that the team was not yet accustomed to.

The MOI activities were sequential and interlinked. The sequence of activities could not be modified, for example: Beagle-2 could not be released prior to the setting of its timer and the retargeting manoeuvre could not be executed before Beagle-2 was released. Any anomaly on the timeline of one of the activities therefore had an impact on the following activity. More importantly, the duration of the MOI phase was fixed by the earliest time at which the fine targeting manoeuvre could take place (driven by the earliest release time of Beagle-2) and the fixed time for the execution of the capture manoeuvre (25th of December 2003 at 02:41:12).

XVII. The Software Upload Mars Express has been developed and built in record time. For various reasons, including the Main Engine performance

described in the next section, the on-board software used at launch required further improvements. Both the Data Management System (DMS) and Attitude and Orbit Control System (AOCS) software had to be updated in flight. Before Mars Arrival the full AOCS software was changed, and the DMS modified in part via patches. The design of the system does not allow the update while the software is running. The software has to be loaded into free areas of the memory, and then a reboot has to be triggered to load the software from EEPROM into RAM. As a reboot implies a complete reconfiguration of the satellite, including the triggering of a Safe Mode, this is a heavy task. Complete recovery from such a Safe Mode triggered by the Ground, which does not include any investigation, still takes one to two days. The new AOCS software was delivered by industry early October, uploaded mid-October, and activated on the 21st of October 2003.

XVIII. The Main Engine Concerns about the side effects of the main engine thrust for absolute worst cases had been raised in the Flight

Acceptance Review. Before using it, the actual torque induced by the thrust of the main engine was predictable with a limited accuracy, in part due to mechanical alignments. It was questioned whether the four 10N attitude control thrusters would be enough to keep the satellite on course during the firing for all possible cases. This resulted in a software modification, which allowed the AOCS to use both main and redundant thruster branches (eight 10N thrusters) for attitude control during MOI. This option was only to be used if in-flight calibration of the torque would still be insufficiently conclusive. The AOCS software offering both attitude control options was ready for use on 21st October. It was debated whether a test firing of the main engine should be attempted, thereby risking the whole mission if attitude control was really lost. It raised an additional point on the lifetime of the main engine once the fuel system for the main engine was primed. The original qualification given was for 40 days, after which nominal performance was not guaranteed. No other mission, American or Russian, had done a test firing of the main engine before using it during capture. After a complementary qualification campaign of the main engine on the ground where industry confirmed the qualification up to 90 days, the test manoeuvre was approved and, after a successful priming of the main engine, was executed flawlessly on 27th October 2003 in the four-thrusters-configuration. This set-up was then approved for the actual capture manoeuvre.

XIX. The Mars Picture During cruise a special science request to turn the spacecraft to take a photograph of Mars from as close as possible was

introduced. Discussions were raised whether an additional workload on an overloaded team, a simple but special activity on the spacecraft side, and therefore a risk to disturb the mission close to arrival where outweighed by the public relation benefits. A compromise was reached and on December 1st, 3 weeks before capture and from five million kilometres away the first picture of Mars was taken, downlinked and processed.

Figure 7 Mars from 5 Million Km (Credit: HRSC)

XX. Summary of an Eventful Journey Recommendations from a pre-launch review, spacecraft anomalies, a hostile environment, sky exploration, revision of the

operations concept, a simulations campaign, together with learning how to fly a complex spacecraft for a complex mission, all kept the Flight Control Team as well as all internal and external teams, busy throughout the Cruise Phase. In the end, the “quiet cruise phase” that was supposed to be five months long from mid-July till mid-December 2003, was extremely loaded. Only a couple of days were finally kept free of any activity related to the direct or indirect preparation of the Mars Orbit Insertion. Figure 8 shows the mission as flown.


Figure 8 Actual Mission Overview as flown (Credit: Astrium)

XXI. The Beagle-2 Release As the Lander did not have any propulsion of its own, Mars Express was used as a targeting mechanism. The spacecraft

was put on a collision course with Mars, aiming at a certain point that would allow Beagle-2 to descend through the Martian atmosphere in a pre-defined, narrow entry corridor. This collision course was tuned up to the exact target point nine days before arrival (three days before Beagle release). The Beagle-2 ejection phase consisted of three main activities:

• The fine targeting nine days before arrival; • The ejection preparation on Beagle-2 and on the spacecraft side, for the various sub-systems concerned:

o Verification of the Beagle-2 battery status and programming of its internal timer. o Programming of the sequence of images by the Visual Monitoring Camera (VMC). o Programming the execution and verification of the spacecraft electrical subsystems: pyrotechnic devices had to

be fired to allow the Spin-Up and ejection Mechanism (SUEM, part remaining attached to Mars Express) to actually release Beagle-2.

o Programming the slews and attitude timeline necessary to obtain the ejection attitude (driven by the entry angle into the atmosphere, imposed by Beagle-2).

• The ejection proper and its confirmation. The proximity to Mars and the criticality of the involved timing in case of problems during the ejection of Beagle-2 led to

a detailed timeline for all remaining operations up to the moment of the Mars Express capture by Mars, and to define and agree a priori upon the possible maximum delay for each activity in case of problems. The major drivers of the criticality during this phase are summarised in the next table. (Figure 9)


Figure 9 Table of Criticality

One of the worst-case scenarios would have been a safe mode in the days between the fine targeting manoeuvre and Beagle-2 release. A Safe Mode typically introduces about 30 cm/s delta-V through the use of thrusters during the Sun and Earth re-acquisition. Over days this could amount to a disturbance in the Beagle-2 trajectory of up to 150 km, much larger than the agreed entry corridor.

With considerable practice during the cruise the FCT was well trained for the recovery from a potential Safe Mode, which would have taken approximately on one day. More than half of all procedures written for this phase were contingency recovery procedures and backup timelines. Should a Safe Mode have happened then a major difficulty would have been to recover accurate trajectory knowledge and correcting again the trajectory as per stringent entry corridor requirements from the Lander before a delayed Beagle-2 release, while leaving enough time for a safe preparation of the Mars Express orbiter capture.

Figure 10 Ejection Contingencies

These sophisticated backup plans were meant to support risk trade-offs in difficult situations where the high profile Beagle-2 mission would have had to be balanced against an increased risk to the orbiter capture, under high time pressure. The next table shows the detailed ejection timeline that was accurately followed during the actual operations. Fortunately, none of the backup plans or contingency procedures were needed.


Figure 11 Beagle-2 Release Timeline

The fine targeting manoeuvre was successfully completed on the 16th of December 2003. After all checks were completed, the commands for the release were sent to the spacecraft on-board Mission Timeline on

the 17th of December.


On the 19th of December the Beagle-2 release commands were executed. The Team had to wait for the execution to complete and for the spacecraft to come back to Earth pointing, before receiving telemetry.

The actual release shock magnitude that would create a torque and an impulse on the spacecraft was not very accurately predictable. Therefore the release was performed under the most stable attitude controller built into the Avionics, the Wheel Damping Mode, which already had been used after each trajectory correction manoeuvre. In addition, ground stations were looking for a shift in the Doppler signal as a result of the delta-V change due to the release.

Confirming the successful release of the Lander was not as trivial as it may sound. The communication set-up on-board Mars Express did not allow for real time observation of the actual release, because the fixed High Gain Antenna would not point towards Earth after the slew to the ejection attitude had started. The low gain omni-directional antennas were not useable at one AU distance from Earth. Telemetry had to be recorded on-board and replayed after the release. Only limited telemetry was available from Beagle-2 after it was switched off following the programming of the entry and landing system. For the verification of the release a small Visual Monitoring Camera (VMC) had been put on the upper side of the spacecraft looking at the bottom of Beagle-2. A series of pictures was programmed to be taken just after the release of the Lander.

Mars Express performed a flawless release. Proof came from the Doppler measurements and the pictures taken by the VMC camera, showing Beagle-2 drift away from the spacecraft.

Figure 12 Beagle-2 20 m away from Mars Express

For the Flight Control Team this was a major milestone successfully passed, but no time could be spent on celebrating. Mars Express was now only six days away from Mars and was still on a collision course.


XXII. The Mars Orbit Insertion The overall phase consisted of five main activities: • Spacecraft retargeting, away from the Mars crash course and towards the insertion point, at MOI – 5 days; • Programming the capture manoeuvre; • Setting Mars Express in capture configuration; • Mars Orbit Insertion (MOI): capture proper; • Resetting the spacecraft into a nominal configuration.

The capture manoeuvre is sketched in Figure 13 below:

Figure 13 Mars Express Orbit Insertion

This phase encompassed a large amount of preparation at SC level. In particular, the MOI required Mars Express to be put

in a very special, very robust configuration (“fail-ops”) to maximise the chances of success of this unique and non-recoverable manoeuvre.

The phase combined activities that were executed during and out of ground contact. The overall operational logic was driven by ground contacts for nominal and contingency situations. Time management followed strict rules:

• All critical activities were executed during New Norcia (NNO) ground station passes wherever possible. • All spacecraft-driven activities were pre-commanded in a previous pass. • Spacecraft-driven activities started one hour after the start of the New Norcia pass, to allow for “NO GO”

opportunity and last chance command uplink. • From the end of the spacecraft activities to the end of the concerned NNO pass, a few hours had to be available to

check the status/performance of the system

Any contingency would have been highly critical. A Safe Mode, for instance, would have impacted the trajectory, which could only have been corrected very late or not at all, depending on the time of occurrence. On the other hand the closer to arrival the Safe Mode would have occurred, the smaller the impact on the insertion point. The navigation requirements for capture were actually less stringent than for the Lander ejection. The altitude of the nominal target insertion point (411 km)


had been optimized to be high enough above the atmosphere but low enough with respect to the need to capture, such that it would have allowed for a non-corrected deviation of a few tens of kilometers. Even if a sub-optimal capture could have been a mission-safe choice, recovery time from Safe Mode in such conditions, would have been extremely stressful. The ground proceeded with extreme care to avoid such situations.

On-board Failure Detection Isolation and Recovery (FDIR) settings, further minimising the risk of undesired Safe Modes, had been defined and were to be selected for the capture proper but were applied only in the last 18 hours before arrival. Their side effect was to leave the spacecraft less auto-protected than it normally is. Therefore the decision was decided to minimise the duration of the “fail-ops” configuration to the minimum that one could summarise as “robust to Safe Mode, fragile to Safe Mode causes”.

Since the “fail-ops” mode established 18 hours before arrival could only drastically reduce, but not fully inhibit all Safe Mode cases, special contingency recovery procedures were written. These would aid the Flight Control Team in getting the spacecraft out of Safe Mode in less than six hours and load a pre-agreed and checked stack of commands, including modified capture sequence, to at least get into orbit. This was possible up to six hours before capture.

Together with the Safe Mode avoidance, the quality of the navigation was a major driver of the phase definition and execution. In addition to normal tracking, interferometric Doppler measurements (“Delta-DOR”) were performed daily by two coordinated DSN ground stations (Madrid and Goldstone for the East-West Delta-DOR, Goldstone and Canberra for the North-South Delta-DOR) to pinpoint the position of the satellite with an accuracy of about 20 meters. The station coverage and the Delta-DOR sessions for the two weeks before Mars arrival are depicted in Figure 14.

Team

B

B2 Prep

MOI recovery

MOI Prep

Team

A…

…Te

am A

Fail Ops

STR slews

MTL U/L

Team

B

B2 Prep

MOI recovery

MOI Prep

Team

A…

…Te

am A

Fail Ops

STR slews

MTL U/L

Figure 14 Ground Station Coverage and Delts DOR

The timeline design also included (for contingency cases) slots for pericentre raising or other corrections (“clean-up manoeuvre”) around arrival - 2 days, a last chance pericentre modification in the few hours preceding arrival and/or a last chance to modify the already loaded capture parameters. These activities were formal options and as such had been submitted to the most strict analysis and approval cycle. They were not to be executed nominally. If the mission had risked only a minor degradation, the proposed modifications would have been formally debated and approved or not – with a likeliness of


rejection increasing with the proximity of Mars. However, they would have been feasible in case of a major orbital anomaly detected very late. The next three tables show the complexity of the entire phase – and reflect its history, as it was executed as per the plan down to the one hour-resolution or better. None of the optional operations were required; neither the possible correction manoeuvre(s) nor the support slews for star reacquisition by the star tracker.

Figure 15 Re-Targeting Timeline

The re-targeting was successfully completed on the 20th of December 2003 to the nominal orbit capture point. There was

no danger any more that Mars Express would crash into Mars. The commands for the Mars Orbit Insertion were loaded into the on-board mission timeline of the spacecraft on the 21st of

December 2003, 4 days before capture. Before uplink, these few tens of commands were checked over and over again by both shifts from the overall Mission Control Team – Flight Engineers, Industry, ESTEC Project, Flight Dynamics and Flight Directors – to be absolutely sure there were no mistakes.


Figure 16 MOI Parameters and MTL Preparation

These commands originally loaded only a preliminary set ensuring capture, and due for replacement by a refined capture sequence about 24 hours before arrival. The whole point of this complex process was to allow as many as possible opportunities for the ground to take control over the spacecraft again, and as late as possible, as a lesson learnt from the ill-fated NASA Mars missions at the end of 1999. However, the most harmless operation is no operation at all. The flexibility was there, but was to be used in a controlled fashion. When one and a half days before arrival the final MOI sequence was computed on the ground and estimated to save a mere 200 g of fuel – for a 200 kg burn – it was debated and collegially agreed not to update the preliminary sequence that had been so well checked and was already on-board. The preliminary sequence stayed as the final one.

Figure 17 shows the detailed capture timeline. The “Uplink Mission Timeline (MTL) for Capture” on DOY 358 is the only mandatory activity that was not performed on time – in fact not at all – over the whole phase, which was otherwise executed as per the book.


Figure 17 MOI Capture Timeline



A special AOCMS mode was available to operate the Main Engine – the Main Engine Boost Mode (MEBM). The main characteristics of the MEBM were:

• The 400 N main engine was used. During the manoeuvre the spacecraft attitude was steered to provide optimal

thrust direction. • The attitude guidance was based on a ground commanded attitude profile, consistent with the required thrust

direction. • The attitude control was performed nominally by one set of four 10N RCS thrusters in on-modulation. • The Reaction Wheels were switched off. • The star trackers were switched off. Attitude estimation on board was based only on gyro measurements. • The Solar Arrays were set to a special position to withstand the mechanical input during the manoeuvre. • A special FDIR logic was enabled aimed at avoiding transitions to Safe Mode that would have interrupted the

manoeuvre, meaning loss of mission. • Should the Main Engine hardware have failed during the burn, this would have been detected by the AOCS

software, which would first have stopped using the Main Engine, and then resumed the manoeuvre using the eight 10N thrusters only. In most cases, unless the Main Engine had failed immediately after the burn start, this would have assured capture on a degraded orbit, but capture nonetheless.

All non-essential units were switched off during MEBM, the only exception being the S-Band transponder, which was

switched on for transmission of a carrier signal (as performed for Beagle-2 ejection). This exception was discussed during cruise and approved a few weeks before arrival – when all parties got convinced that the extra power consumption was affordable and the extra risk of Safe Mode nil – no on-board software monitors the S-Band transponder. Moreover, the need for even primitive information from a spacecraft during its critical phases is another lesson learnt from previous ill-fated missions – and one could today include Beagle-2 as another example. S-Band tracking had a potential benefit for Mars Express, should the MOI have gone partly wrong, like the Main Engine stopping too early. Also it would have been extremely useful for future missions in case something went completely wrong and Mars Express was lost. It was however acknowledged that the S-Band signal did allow the ground to react to any anomaly occurring during a 35-minute burn, while having 16-minute round trip duration.

In fact, there were no other means of communication while the main engine was firing, as the high gain antenna did not point towards the Earth. The DSN ground station in Canberra tracked the S-Band signal from one of the low gain antennas. Mars Express has two antennas of that kind, normally of no use at this distance from Earth. The signal is too weak to transport telemetry, but the ground station locked on the S-band carrier and was looking for a shift in Doppler measurements, showing the change in spacecraft velocity during the main engine firing. The rear low gain antenna was in use, as per spacecraft configuration during the whole cruise.

XXIII. The Night of the Capture - A Personal Experience

The date for the Mars Orbit Insertion was the 25th of December 2003. It was to be a Christmas that nobody in the Flight Control Team would ever forget.

Public interest in the Mars Express and Beagle-2 missions had reached tremendous levels, resulting in journalists and TV crews appearing more and more often at ESOC. The ESA web portal, typically frequented by 500,000 to one million times a month was catapulted in December 2003 to more than two million visits!

A web-cam was installed in December 2003 in the Main Control Room at ESOC and one could follow the Mars Express engineers performing operations 24 hours a day on the internet, up to reaching the final orbit in January.

The press had even attended simulations of the arrival and nearly everyday the latest status could be read in newspapers and seen on TV around the world. The excitement had not only got hold of the whole team, but also started to fascinate the public in a way unknown so far to European spacecraft operation engineers.

When the day shift came in to replace the night shift in the early hours of Christmas 2003, none of the night shift team left. Nobody was going to miss this unique opportunity to witness making history. All the tiredness was replaced by another adrenalin rush. The tension was high when telemetry indicated at 01:40 UTC in the morning of the 25th of December that the slew towards the firing attitude had started. As expected the X-Band signal was lost at the start of slew. What was not expected was that also the S-Band signal degraded shortly afterwards. In the preparation period focussed on the essentials, the visibility of the default low gain antenna had simply not been checked. The satellite slewed to its firing attitude in a way that turned the rear low gain antenna away from the Earth direction. The front low gain antenna would have instead given good coverage. Luckily the signal was going in and out, so the large 70m NASA DSN Antenna in Goldstone could still identify the expected Doppler shift when the engine started firing. The signal was then lost as during the end of the capture Mars itself occulted Mars Express.

At this stage, there was proof that the manoeuvre had started, but this was followed by another long waiting period. There were still possible failure scenarios with recoverable or non-recoverable outcomes, depending on the Main Engine performance. The team had also been preparing for the unlikely but not impossible “quasi–insertion case” on a too large orbit “that would not close”, but could be recovered if an additional manoeuvre was executed early enough in the few hours after the capture main burn. This would complete the capture on a non-nominal orbit but still around Mars instead of missing it by very little.

At 03:46:29, exactly at the calculated time for a successful manoeuvre the Canberra ground station picked up the S-Band carrier as Mars Express emerged from behind the Red Planet. At that moment the emotions went high - applause started in the main control room! People were crying, laughing, jumping about, hugging who ever was close… There was no information yet what the achieved orbit was like, but the actual news that Mars Express really had captured around Mars, was overwhelming! Many years of work for engineers and technicians all over Europe – and at ESOC for the Mission Control Team had finally paid off.

Figure 18 FCT with the German Science Minister Edelgard Bulmahn after successful Capture



Later, after orbit determination had been completed, it was found that the Mars Orbit Insertion had been perfect, within 0.5% of predictions. The first telemetry from the spacecraft confirmed that the performance of the main engine had been as expected.

Mars Express was now a mission around Mars and a European success. This fantastic Christmas morning was also expecting a successful landing of Beagle-2, which should have occurred nearly at the same time. Two hours later we learnt that the initial attempts by NASA’s Odyssey and the Jodrell Banks Telescope failed to contact Beagle-2 on the Martian surface. The next couple of weeks showed that no contact could be established and after two months of trying to find the lander, the Beagle-2 mission was declared lost.

XXIV. Some Lessons Learnt The lessons learnt during the Mars Orbit Insertion preparation and execution could be the subject of a discussion on their

own. Some striking experiences are summarised here in the perspective of further elaboration: • Close to the given financial envelope, and benefiting from the Rosetta developments, with Mars Express ESA has

entered the world of planetary missions. • Thanks to software upgrades during the flight, and to a design which allowed a large number of parameters to be

tuned, the star tracker and its handling by the AOCS was significantly improved and the controllability of the Main Engine has been made more robust. Modifiable autonomy is a key to overcome the unknowns of the environment and unknown side effects of spacecraft deficiencies;

• Replacement of complete software components requires Safe Mode of the full spacecraft on Mars Express, including unaffected systems. This has sometimes increased the risk level and required more effort than actually necessary. For a mission with a long lifetime, or with phases of variable nature, or with unknowns at mission design time, software upgrades in-flight should be included in the basic design of the satellite, with minimal implications on operations;

• The Solid State Mass Memory was long considered an essential part of the capture configuration, in view of collecting unique data; but this unit was left off after all. The baseline configuration is worth challenging until rather late, especially when operating non-fully-nominal units under extreme constraints;

• Despite the extremely thorough preparation of the MOI phase, its formal processes and validation stages, an obvious, though minor, element had been overlooked: the selection of the optimal low gain antenna during capture. The fact that everything has been planned and checked correctly should always be questioned, also for non-essential items, and adequate processes put in place;

• The dual simulations campaign approach was successful in building a knowledgeable team for critical phases and, for the MOI Simulations, in bringing this team far beyond its seemingly good knowledge of a spacecraft they were already flying. Staggered simulations are vital for a mission with many different phases, even if this means a higher workload for the team. These simulations need to be as close to the relevant phase as possible, to maximize the efficiency of the training;

• The dedication of the Mission Control Team through the storms of the cruise has been key to the success of this mission. This dedication was illustrated by getting the spacecraft, the procedures and the fallback processes ready when needed despite the time pressure, the unexpected and the expectations! Dedication is of course required from professionals, but since it cannot always be taken for granted, the team motivations and goals should be managed as such from the beginning of the ground segment and operations implementation.


XXV. Epilogue In the meantime, Mars Express has produced a wealth of scientific data in already more than 3000 orbits. The high-

resolution camera regularly delivers colour and three-dimensional pictures in unprecedented resolution and quality. Water ice on the polar caps has been observed directly. Correlated amounts of methane and water vapour have been found in the atmosphere, reviving the speculations and hopes for present life on the Red Planet. Most recently the MARSIS Radar Antenna, which was only deployed in 2005, has provided first proof of subsurface (frozen) water existing on Mars.

On a more modest but still exciting scale, for the Flight Control Team the work continues in order to ensure a steady flow

of scientific data until the end of Mission. A mission extension for another Martian year (2006-2007) has already been approved.

The team is proud of having contributed to the first European mission to another planet in our solar system. Not only have the team members proven their professionalism and dedication, but still today, for the routine operations, they show their attachment to Mars Express: nearly 3 years after Launch and 2.5 years around Mars, the core of the original team is still together, performing the day-to-day operations which are rarely routine but never boring. Operations are exactly that: orbit after orbit, every orbit, observations are commanded; byte after byte, every byte, data is brought back to Earth, for the benefit of the community that out of this laborious effort will produce science – and sometimes break the news again.

References [1] Jacques Bordes, Mars Express Mission Outcome: Scientific and Technological Return of the first European Satellite

Around the Red Planet, IAC-04-Q.3.a.06, 22/09/2004 [2] Michael McKay, Mars Express Operational Challenges and First Results, IAC-04-Q.3.a.07, 06/10/2004 [3] Zeina Mounzer, Ensuring Readiness for Europe’s First Mars Mission – Team Building Through Simulations

[American Institute of Aeronautics and Astronautics SpaceOps 2006 Conference - Rome, Italy ()]...

Documents

Transcript of [American Institute of Aeronautics and Astronautics SpaceOps 2006 Conference - Rome, Italy ()]...