Sleeping Satellites – Nursing Cluster through Critical Eclipses
Contents
1. the Flight Control Team in ESOC was confident that the satellites could be operated during eclipses using only a fraction of the power specified by the Spacecraft User Manual However there was the concern that under certain circumstances the command decoder might not restart correctly after loss of power Without the decoder ESOC s commands could not be routed to their target units to revive the satellite Preparations The Flight Control Team held regular discussions with industry and ESTEC experts to come up with new approaches and in 2004 a strategy to prolong the battery lives was in action Meanwhile the team concentrated on adapting the power thermal and data handling operations individual treatment of the 20 batteries warming the satellites recovery from all low power situations and rules to allow fast decisions when necessary 28 esa bulletin 129 february 2007 The Cluster orbit in September 2006 the satellites are about to enter Earth s shadow around apogee Months before the eclipses a ground station plan was prepared to enable real time contact with the satellites at the start and end of each eclipse Extra ground stations Kourou French Guiana and the deep space antenna in New Norcia Australia were prepared for Cluster Working with Ageing Batteries During eclipses each satellite is powered by five silver cadmium batteries In the early 1990 s when Cluster was designed these w2. after the short eclipses could not be relied on months later for such aged batteries Measurements taken when the batteries Fach satellite carries five batteries www esa int were brought out of empty storage in September would have been too late Procedures for all the possible cases had to be prepared in advance New Power Scenarios The main problem was with Space craft 1 three of its five batteries had been declared non operational Two had cracked and one had a suspected failed cell The energy drawn by the satellite s units that cannot be switched off was more than could be stored in the remaining batteries Tests on the three non operational batteries looked for any way to bring them back to life The results were positive two could be used with some constraints Even with these results the situation for this satellite remained critical one battery non operational two requiring precautions one showing a large internal electrical leakage and the only healthy battery had low capacity Altogether the capacity was around 12 Ah 4A for 3 hours This equated to 45 W available for the subsystems whereas 92 W would normally be required during an eclipse even with the payload transmitter and all other non essential units switched off The problem was clear either find ways to reduce the consumption to a level the batteries could handle or they would run flat and the satellite would shut dow
3. power requires powering down the payload and other non essential units These priorities were used to establish the Flight Rules for any satellite and any eclipse a particular strategy should be adopted only if there is enough capacity even if the weakest battery fails and if the www esd int Critical operations in the Cluster control room available battery capacity is 20 greater than required for nominal and heater off scenarios and 10 greater than for the decoder only option if the battery situation worsens on spacecraft 2 3 and 4 no attempt will be made to restart payload operations between eclipses These priorities and Flight Rules superseded those previously laid down in the Spacecraft User Manual and Flight Operation Plan They were approved by the Cluster Project Management shortly before the start of the eclipse season The uncertainty in the capacity prediction and the need to be prepared for the worst case meant that new procedures had to be ready for all three power options heaters off decoder only and power down on all four satellites As the new procedures took shape they were approved by experts and industrial partners before being tested on the Cluster Simulator The new procedures www esd int worked well and there was a growing optimism that they would bring the satellites safely through the eclipses But the true test was still to come Eclipse Operations Before each eclipse
4. Sleeping Satellites a Nursing Cluster through Critical Eclipses j f j J j j ce J rgen Volpp James Godfrey amp Steve Foley Mission Operations Department Directorate of Operations and Infrastructure ESOC Darmstadt Germany Silvia Sangiorgi amp Pontus Appel LSE Space Engineering amp Operations AG Darmstadt Germany Markus Pietras Department of Mechanical Engineering Technical University Darmstadt Germany Philippe Escoubet amp Horst Fiebrich Directorate of Scientific Programmes ESTEC Noordwijk The Netherlands Max Schautz amp Bernd Lehmann Directorate of Technical and Quality Mangement ESTEC Noordwijk The Netherlands launched in 2000 to investigate the magnetic interaction between the Sun and Earth Designed to last 3 years the mission has now been extended to the end of 2009 But the batteries of the satellites are well beyond their design lives and are starting to fail the power situation first became critical during the long eclipses in September 2006 The battery aboard one could not power the heaters or computer so new options had to be developed to avoid dangerous low temperatures and to regain control after each eclipse E SA s fleet of four Cluster satellites was The Cluster Mission The Cluster mission is a critical part of an international effort to resolve questions about the Earth s magnetic connection with the Sun For 6 years the four satellites have been makin
5. den design margins and conceived new ways of operating the satellites Through this team effort the Cluster fleet survived the long eclipses unscathed to continue their valuable scientific mission Acknowledgements The authors thank the experts who contributed to the discussions and the development of new strategies drawing on their knowledge from the Cluster design integration and test phases G Lautenschlager and H Sondermann Astrium and T Aielli AAS I Laben The time critical operations during the intensive eclipse season would not have been successful without the excellent support provided by the ESTRACK operations teams at ESOC and the ground stations and the dedication of the entire Cluster Flight Control Team esa Further information on Cluster and its mission can be found at http sci esa int cluster www esa int
6. ere the only non magnetic batteries available as Cluster s instruments were intended to measure magnetic fields the internal fields had to be minimised Their short lifetime of typically 2 5 years is limited by the amount of cadmium which is gradually dissolved by the aggressive electrolyte The lives are also limited by mismatch between the individual cells of a battery building up over time On Cluster the Battery Realignment Facility reduces this mismatch by discharging each cell individually Monitoring by the computer also checks the batteries preventing over charging discharging which can generate gas Since 2004 two strategies have been used to extend the batteries lives the satellite temperature has been lowered slowing the rate that cadmium is dissolving and all the batteries have been completely discharged and left unused for months at a time The associated risks were accepted because these measures dramatically reduce the rate of deterioration By April 2006 16 of the 20 batteries were still operational but their capacity had halved Three had cracked cells and leaking gas and electrolyte had caused small orbit changes To minimise the risk of further cracking the perform ance of all the batteries was being monitored individually To decide on the approach for each satellite it was important to forecast battery behaviour how much energy could each store and provide The measurements taken in April
7. g 3 D measurements of the fine detail in our magnetosphere to discover how the magnetic field responds to solar activity The scientific achievements so far were summarised in Bulletin 121 February 2005 Since launch in 2000 the fleet has been controlled from the Agency s European Space Operations Centre ESOC in esa bulletin 129 february 2007 27 Gesa Science esa Science Darmstadt D Originally planned to last until 2003 the mission has been extended twice into 2005 and then to the end of 2009 with a review in 2007 Before the second extension was approved the satellites health was analysed to predict whether they could reach the new end date The most difficult conditions occur during long eclipses when the Earth shadows the power generating solar cells Each year there are short eclipses of 15 40 minutes around the orbit s perigee in March and long eclipses around apogee in September The three or four long eclipses each last about 3 hours The batteries that power the satellites during eclipses are clearly the most critical units It was evident they would fail before the end of the extended mission and that Cluster would have to find ways to survive eclipses without electrical power The satellites would be without onboard control the high power amplifier and propellant pipes could cool too far and the computer would require recovery after each eclipse With 4 years operational experience
8. he effects of different heating strategies were studied using an existing computer thermal model updated with flight data and a new model developed for this Thesis As the satellite cools down during eclipse the most critical items are the transmitter s High Power Amplifier HPA and the propellant pipes The HPA might be damaged if it drops below 30 C and the oxidiser might freeze if the pipes drop below 12 C The projected storage capacities of the Cluster batteries in August 2006 compared to the needs for a nominal configuration during the longest eclipse of each satellite 3 h 4 min for Spacecraft 1 In sunlight the solar array generates more electrical power than needed for the instruments and subsystems so the excess is used to regulate the temperature of the Main Equipment Platform MEP Enough power to maintain the MEP at about 15 C is directed into a network of heaters During eclipse seasons more power can be made available for heating only by switching off other units During eclipses the HPA and propellant pipes are protected from getting too cold by three heaters that turn on when the temperatures drop below set values The 80 W drawn by these heaters is a large burden on the weakened batteries so in previous years their activation was delayed by pre heating the spacecraft to 20 C before each eclipse The extra power was made available by switching off the HPA and payload In 2006 with the batteries
9. ing 6 kg each and currently containing a total of 50 kg of oxidiser and fuel The tanks are well insulated and have 40 W of heaters The thermal models suggested that any heat stored in the tanks could buffer the temperature of the rest of the satellite Tests on the flying satellites were encouraging the tanks could be heated from 16 C to 35 C in 24 hours and the insulation was just right to store the heat and release it slowly into the rest of the satellite during the eclipse This would be enough to slow the temperature drop of the HPA and propellant pipes keeping them above their critical temperatures Operating Without a Computer It was clear that Spacecraft 1 s battery situation required the decoder only configuration However given the fragile state of the batteries the Flight Control Team had to be ready to switch to the power down option at short notice Even if power down was not used in 2006 it will be needed some time as the batteries on all the satellites continue to age Yet the power levels were not the only consideration when deciding between these options With the decoder only approach all possible loads such as the computer are switched off This is 30 esa bulletin 129 february 2007 i i if j i i SSSSSEREREREES tee eee eee iima TAHR Tarp Propeller pipes Tamga A simulation shows how warmed propellant tanks raised pipe temperature before an eclipse against the usual philosoph
10. n and possibly die Operating the satellite with critical systems switched off had never been considered before and it was not covered by either the Spacecraft User Manual or Operating Procedures It was time to think outside the box The first step was to switch off the data recorder and to disable all heaters www esd int leaving only the computer powered This reduced the average consumption to 75 W still too high The only other load that could be switched off is the computer The others are permanently connected to the power bus These non switchable loads are the main and redundant receivers and decoders that handle commands from ESOC and the power unit which conditions controls and distributes the power With the computer off the power needed was finally around the target value of 45 W If it turned out before an eclipse that the available power would be less than 45 W then only one option remained disable battery discharge after the eclipse began instantly shutting down the entire satellite This power down strategy would protect the batteries from cracking and reserve their energy for use during the restart after leaving eclipse Keeping the Satellite Warm Given that the power shortage had serious thermal implications and considering the increasing battery differences between the satellites Markus Pietras began studying the problems for his Masters Thesis at Darmstadt University T
11. of Spacecraft 1 even weaker these heaters could not be used To prevent the satellite from getting too cold it needed to be pre heated to more than 22 C The orbital period of 57 hours allows 54 hours between eclipses to charge the batteries and to warm the satellite The solar arrays do not provide enough power for simultaneous heating and charging so in the past the batteries were charged for the first 30 hours after eclipse leaving the rest for the heaters to raise the MEP temperature By September 2006 several batteries on Spacecraft 1 showed such large internal leakage currents that this could not be done a large part of the energy in the batteries would leak away while the MEP was being heated Conversely if the satellite were heated during the first 24 hours it would then have 30 hours to cool while the batteries were charging Another solution was needed Propellant Tanks as Thermal Capacitors Whereas there was no way of storing enough electrical energy perhaps it esa bulletin 129 february 2007 29 Gesa Science esa Science In the new pre heating strategy heat stored in the propellant tanks frees the time for the batteries to be charged close to the eclipse could be done for thermal energy Previously pre heating concentrated on warming the MEP but perhaps heating other thermal masses could be a more effective way of keeping critical units warm Each Cluster houses six propellant tanks weigh
12. ommands to turn off the transmitter it was left until last By then of course the transmitter was off and all signals from the satellite had ceased Then although it contradicts accepted practice the low level commands to turn off the computer were sent in the blind with no way of confirming that the commands had been executed These commands were distri buted directly to the power switches and did not need to be processed by the computer Spacecraft 1 was now in sleep mode ready to enter the Earth s shadow a few minutes later After 2 5 hours as Spacecraft exited the eclipse it was time to switch on the computer and recover the satellite The low level commands to turn on the computer were sent again in the blind Allowing time for the computer to boot the high level commands were sent a minute later to turn on the transmitter A few more nail biting seconds and an alarm sounded on the control system a signal from the satellite woken from its hibernation But there was no time to relax The team had only 2 hours contact time to restore the satellite to its normal configuration and load the commands to prepare for the next eclipse Some 50 hours later the operation was repeated for the second eclipse and then again for the third until finally the most critical and stressful operations since Cluster s launch were completed Although the focus was on Spacecraft 1 the team also managed the eclipses fo
13. r the other three Fortunately they behaved as predicted and there was no need to resort to the special strategies Conclusion With the pre heating none of the satellites units reached critical Top view of Spacecraft 1 with the temperature plots of the most critical units during the 3 h 4 min eclipse of 18 September 2006 THRUSTER 1A TEMPERATURE ih he re IPE wep relhrenad m 32 esa bulletin 129 february 2007 HPA TEMPERATURE temperatures In fact the effect of using the tanks as heat stores was greater than expected the temperatures at eclipse exit were above expectation The groundwork was also laid for future eclipse operations anew strategy for heating the satellites was developed and validated the decoder only configuration was validated the procedures for the power down scenario are ready for use if they are ever needed One major uncertainty remains with the command decoders will they function after a power down eclipse The answer will come in September 2007 when the worsening situation will demand that approach The overall problem was simple reduce the power consumption in eclipses to what could be supported by the reduced battery capacity The resolution however required a multi faceted approach from an international multi institution team involving the Flight Control Team at ESOC and experts from ESTEC and industry They identified the critical areas discovered hid
14. the batteries latest parameters were compared against requirements and the rules were invoked to decide which option should be followed In all cases the batteries were stronger than expected Spacecraft 2 3 and 4 adopted standard strategies for all the eclipses For Spacecraft 1 the decoder only option was used avoiding the feared command lock out The satellites are separated by 10000 km so did not all experience eclipses on the same days fifteen eclipses were spread across 12 days The first orbit saw an eclipse only for Spacecraft 2 the coldest but with the strongest batteries The second orbit had eclipses for 2 3 4 The only day when all four were eclipsed was 15 September beginning with 1 The Team was still refining and testing procedures on the Simulator right up to this day Then while part of the Team took care of the others a Tiger Team prepared 1 for its first eclipse Some 30 minutes before it began they used high level commands processed by the computer to switch off all the satellite systems one by one until only the transmitter and the computer remained As the computer is required to process The timeline of Cluster eclipses in September 2006 The eclipse durations are indicated hr min 15 September red was the only day when all four satellites were eclipsed as p IAT onSop asap 10Sep T Agap asep rit esa bulletin 129 february 2007 31 Gesa Science esa Science the c
15. thout monitoring Unlike power down the SRL would not trigger allowing the Team to choose when and how to turn on the computer after the eclipse The power down option should be used only if there is not enough battery capacity to keep even the decoders powered the potential restart problem could not then be avoided anyway This would prevent over discharging the batteries and keep some energy in them This energy would power the heaters when the SRL triggers at eclipse exit preventing multiple restarts of the computer Flight Rules and Procedures In addition to preparing for all the possible operating scenarios the Flight Control Team also needed a set of rules to decide which to choose for each eclipse The priorities for maintaining the health of the satellites were defined Priority 1 maintain power to the decoders All other units would be powered down in preference to losing power to the whole satellite during an eclipse and thereby risking loss of commanding through the decoder Priority 2 protect the batteries New monitoring schemes were introduced to ensure that batteries were neither over charged nor over discharged With the computer off the batteries could not be monitored so battery predictions should always be calculated with conservative margins Priority 3 maintain critical units within thermal limits Pre heating the MEP and propellant tanks should follow the thermal model predictions Any additional
16. y of safe spacecraft operations the commands to turn off the computer were intended to be used only during ground testing With the computer off the battery voltages cannot be monitored to prevent them from discharging too deeply This risks generating gas that could damage the batteries After a power down eclipse power can be restored only when the solar array is illuminated by the Sun as the eclipse ends The amount of electricity generated gradually increases over about 15 minutes as the satellites emerges from the eclipse penumbra The decoder circuits were neither designed nor tested to cope with this slow power ramp up and the manufacturer was concerned that they might not restart correctly If both decoders were affected the satellite would no longer be able to process commands from the ground The return of power also triggers the System Reconnection Logic SRL automatically turning on the computer activating the batteries and turning on thermostatic heaters As the satellite is cold the heaters may try to draw more power than is available causing the voltage to collapse and triggering a restart of the computer This might repeat several times until enough power is available The decoder problem is considered unlikely but its consequences would be far more serious than the other potential problems Whenever possible the decoder only option should be used even if this means operating the batteries wi
Download Pdf Manuals
Related Search