Thousand Times through the Atmosphere of Mars: Aerobraking the ExoMars Trace Gas Orbiter

Transcription

1 SpaceOps Conferences 28 May - 1 June 2018, 2018, Marseille, France 2018 SpaceOps Conference / Thousand Times through the Atmosphere of Mars: Aerobraking the ExoMars Trace Gas Orbiter Michel Denis, 1 Peter Schmitz, 2 Silvia Sangiorgi 3 European Space Agency, Darmstadt, D , Germany Robert Guilanya 4 GMV, Darmstadt, Germany Pia Mitschdoerfer 5 European Space Agency, Noordwijk, 2201 AZ, The Netherlands Mario Montagna 6 Thales Alenia Space Italy, Torino, Italy Hervé Renault, 7 Nicolas Kutrowski 8 Thales Alenia Space France, Cannes, France ESA s Trace Gas Orbiter (TGO), first mission of the ESA-Roscosmos ExoMars cooperation programme entered into orbit around the Red Planet in October TGO has been assigned a low, quasi-circular two-hour period orbit to maximise coverage for science purpose while providing frequent and regular contacts with Mars landers. To achieve the final orbit from the 24-hour period, TGO started in March 2017 a one-year long phase of Aerobraking, reducing by a small amount the energy of the spacecraft at each pass through the atmosphere without the use of chemical propulsion and therefore reducing, revolution for revolution, its orbital period. This paper recalls how the spacecraft hardware and software is designed to support the overall mission and Aerobraking multiple constraints. It describes the on-board logic allowing to operate efficiently and autonomously, managing a very large variability in the decelerations through the atmosphere and regularly updating the timing of the commands already on-board, while offering robust protections. It explains how the operational long-term plans and orbit evolution profiles were constructed. It shows how the last and most demanding Aerobraking part has been adapted based on early experience from the first part. The paper describes how the navigation and protection 1 ExoMars Flight Operations Director, Directorate of Operations, OPS-OPM. 2 ExoMars TGO Spacecraft Operations Manager, Directorate of Operations, OPS-OPE. 3 ExoMars TGO Deputy Spacecraft Operations Manager, Directorate of Operations, OPS-OPE. 4 ExoMars TGO Flight Dynamics Manager, Directorate of Operations, OPS-GFS. 5 ExoMars TGO Mission Manager, Directorate of Human Spaceflight and Robotic Exploration, HRE-PE. 6 ExoMars Avionics responsible, Head of Avionic, Data Systems & Communications Design, Domain Science and Observation Italy (DESI). 7 ExoMars TGO GNC Lead Engineer, Expert and architect of AOCS and GNC, Competence Center Platform and Integration France (CCPIF). 8 ExoMars TGO GNC and Testing Engineer,. Competence Center Platform and Integration France (CCPIF). 1 Copyright 2018 by ESA. Published by the American Institute of Aeronautics and Astronautics, Inc., with permission.

2 processes were tuned during the phase itself. The overall performance of almost one thousand atmospheric passes is synthetized, as well as the fine-tuning of the autonomous altitude control and of the spacecraft Fault Detection, Isolation and Recovery. The description of ground-based control processes shows how the intensification of operations on ever shorter orbits was coped with. The paper addresses the usage of the ESA Tracking deep space antennas (ESTRACK) complemented by the NASA deep space network (DSN). The final part of the paper draws lessons from this unique experience, which sheds an interesting light not only on the Aerobraking techniques, but also on large scale management of operations involving also in-flight industrial support, and on management of expectations for all stakeholders in the ExoMars programme.. I. Introduction A. The ExoMars Programme The ExoMars Programme is Europe s next step in the robotic exploration of Mars, aiming at searching for past or present life on Mars. ExoMars is a cooperation between the European Space Agency (ESA) and Roscosmos and comprises two missions. The first mission was launched in March 2016 with the Trace Gas Orbiter (TGO) carrying the Schiaparelli Entry, descent, and landing Demonstrator Module (EDM). In addition to the delivery of the EDM, the objective of the TGO is to search for signs of life from Mars orbit: a detailed analysis of atmospheric trace gases like methane will be conducted and the Mars surface will be studied to identify possible trace gas sources stemming from biological processes that are still active. The TGO will also provide a data relay service for existing NASA rovers as well as for the rover and lander of the second ExoMars mission. The objective of the EDM was to prove landing technologies and perform surface measurements, but unfortunately the last phase of the landing sequence wasn t successful and the lander was lost. The second mission will be launched in 2020, composed of a Carrier Module (CM) and a Descent Module (DM) delivering a Rover and a Surface science Platform (RSP). The rover will be searching for signs of past life as well as for chemical indicators of extant life, and will be able to drive several kilometers and to drill down to 2m below the surface. The surface science platform will perform atmospheric and geophysical investigations. B. The Trace Gas Orbiter TGO The ExoMars 2016 spacecraft was launched from Baikonur with a Proton launcher on 14 March At liftoff the composite of the Trace Gas Orbiter (TGO) and the Entry Descent and Landing Demonstrator (EDM) weighed kg subdivided as follows: TGO dry mass kg, TGO propellant kg (plus 8.5 kg of pressurant), EDM total mass kg (including 46.2 kg of propellant for landing control). It was 5.2 m tall and fitted the Proton 13 m fairings with a diameter of 3.8 m. The TGO was designed for a maximum Launch mass (including EDM) of 4332 kg with a dry mass of maximum 1400 kg. The mass optimized design was able to achieve a dry mass of 1270 kg with typical inertia (dry mass without EDM) of 4500/5700/2200 kgm2. The propulsion subsystem is a bipropellant monomethyl hydrazine (MON-MMH) with two 1107 liter propellant tanks housed in central tube feeding a 424 N main engine and a set of 10 Nominal (+10 Redundant) reaction control thrusters. 2

3 The electrical power is provided by two deployable solar array wings with a total surface of 21.7 m2 covered by triple Junction AsGa cells delivering 2200 AU from the sun. Each wing can be moved through a single axis Solar Array Drive Mechanism (SADM). The communications are ensured by 2.2 m X-band High Gain Antenna (HGA) mounted on a 2 axis Antenna Pointing Mechanism (APM) allowing simultaneous nadir pointing of the instruments and Earth communication while in Mars orbit. The APM was also used during Aerobraking phase to increase the duration of the ground contacts during the short orbits phase. The Data handling system is based on a central computer (SMU) with an ERC32 processor with 8 MB RAM, 4MB EEPROM and 2GB Mass Memory RAM (1.5GB used 0.5GB for redundancy). The instruments and UHF communication system are interconnected through Spacewire links to a Payload Data Handling Unit (PDHU) which is based on a LEON2 FT processor, with 40 Mb SRAM and 1Tb (end-of-life) Flash memory storage capability. The payload suite is constituted of 4 instruments mounted on a stable payload deck. The instruments will allow to seek for evidence of gases that could be signatures of active biological activity. In particular they will allow to detect and analyse methane and other trace gases in the Mars atmosphere in extremely low concentrations with a three orders of magnitude better accuracy compared to previous measurements performed by ESA s Mars Express and NASA s Curiosity rover. The camera will support the characterization of features on the surface that may be related to trace-gases sources. The instruments will also allow to look for water-ice present below the Martian surface, which together with the potential trace gas sources would help to select future mission landing sites. An addition to the scientific payload the TGO hosts also a UHF communication sub-system that ensures a bidirectional link between the TGO and landers or rovers on Mars surface. Its principal purpose is to support the Rover and Surface science Platform of the ExoMars 2020 mission but it will also support NASA s Opportunity and Curiosity rovers as well as NASA s Insight lander. C. ExoMars Industrial Support Organization Industry is supporting the operations since the beginning of the mission. The maximum effort was put into the support of the LEOP and Near-Earth Commissioning phase when the performances of the spacecraft were deeply verified by the Industrial design team. However, the most challenging phases were executed well after the launch, namely the EDM separation and TGO Mars Orbit Insertion (MOI), which occurred between 16 and 19 October 2016, as well as the long Aerobraking phase which lasted from March 2017 up to February Since launch, industrial support has been provided to ESA s European Operations Control Centre (ESOC) with a single Industrial reference contact point that, in case of need, involved the experts of the main spacecraft disciplines to provide the required clarification or answers: software, data handling, as well as Guidance, Navigation and Control (GNC). In support to the expert analyses an Avionics Test Bench (ATB) is available and kept fully operative in Thales Alenia Space Turin. The TGO ATB is composed of an SMU functional model with both main and redundant sections, the PDHU functional model with main and redundant section, a Star TRacker (STR) functional model, the UHF Electra radio prototype model (PM) and the four instruments Electrical Interface Models (EIM) capable to interact on the 1553 bus receiving commands and generating telemetry like the flight units. On this bench the real flight SW images run in the different computers that are all fully representative of the performances of the flight units. Tests simulating different phases, can be executed. The bench is accessible from ESOC so that its TGO Mission Operations Control System can send commands and receive telemetry like from the spacecraft. This test bench was largely used in preparation of the main events (EDM separation, Aerobraking start, new Central software (CSW) upload, Aerobraking restart after the superior conjunction season) for dedicated System Validation Tests (SVT); ESOC could verify the correctness of the flight procedures, simulating the most critical manoeuvres before execution in flight. The bench was also used by Thales Alenia Space to investigate some anomalies, to test CSW modifications, and to assess new proposed procedures. The availability of the Electra PM allowed also RF compatibility tests with the EDM UHF system, with different NASA landers simulated by the Electra Ground support equipment and it will be used to perform compatibility tests with the ExoMars 2020 mission elements. The coordination between ESOC and industry during all phases including Aerobraking was very efficient. Quick and precise reactions were ensured whenever some unexpected events occurred. 3

4 D. Aerobraking Principles and First Applications Aerobraking consists of using the drag of the upper layers of the atmosphere to decrease the spacecraft velocity and reach a lower energy target orbit. This technique was first used by the NASA JPL Magellan mission in Venus in Since then, it has been repeatedly used in Mars by several NASA JPL missions. From 1997 to 1999, Mars Global Surveyor first used it at Mars to reduce the orbital period from 45.5h to 1.7h [1]. Afterwards, the 2001 Mars Odyssey spacecraft completed Aerobraking after less than 3 months in It reduced the orbital period from 18.5h to 1.9h [1]. Finally, the Mars Reconnaissance Orbiter performed Aerobraking from March to August 2006 to reduce the orbital period from 35.5h to 1.9h [1]. From , the ExoMars TGO spacecraft successfully completed the Aerobraking phase, reducing the orbital period from 24h to 2h. This was the first time that an ESA spacecraft and its operations were designed and used for Aerobraking to reach the science orbit. Several hundreds of passes through the thin regions of the atmosphere at a high altitude are required for such a reduction of orbital period in order to ensure that the heat caused by the friction does not damage in any way the spacecraft. Effects of suddenly occurring variations in atmospheric density make it very difficult to predict by how much the speed would decrease in each pass this poses a challenge not only to the spacecraft designers but particularly also to the spacecraft operators. E. Paper structure and contents Chapter III describes how the TGO has been designed and built by Industry to realize and validate the core Aerobraking hardware elements, the software attitude controllers and the on-board Fault Detection, Isolation and Recovery (FDIR) part of the TGO autonomy. It explains how the Flight Control and Flight Dynamics teams have validated concepts and procedures in advance of this phase on the avionics test bench in Industry and on the ESOC TGO operations simulator. Chapter IV presents the overall operational strategy and reports chronologically the Aerobraking operations as they were run from Walk-in in March 2017 to Walk-out in February 2018, with the details of each critical and routine sub-phase. Chapter V derives from the observed facts and events on-board and on-ground the main lessons learned during Aerobraking for spacecraft and atmospheric performance, ground station and ground control systems, as well as interaction of the teams involved. 4

5 II. TGO design for Aerobraking A. Spacecraft Hardware 1. General layout of the TGO In order to allow for Aerobraking, the TGO configuration has been defined as follows: The X face of the spacecraft, which hosts the 424 N main engine, is exposed to the heat flux by the Sun during cruise to Mars and during any potential safe mode. During Aerobraking this face is also exposed to the heat flux caused by the friction (aeroflux) when grazing through the atmosphere. Figure 1. TGO configuration The Solar arrays provided most of the drag force during the atmospheric passes. The position of their attachment point on the TGO have been shifted from the centre of mass to ensure passive aerodynamic stability during passes (about 0.5 m lever arm). The High-Gain Antenna (HGA) is kept in (re)-stowed position n during the passes with its back face exposed to the aeroflux. 2. Thermal High-temperature Multi-Layer Insulation (MLI) has been used for all external surfaces. All externals items on the TGO (sensors, HGA, ) have beenn specified to be exposed to the worst case aero thermal flux that can be encountered during a safe mode. 1 V 3 Although the aerothermal study shows locally lower fluxes, thee dynamic heatt flux ( 2 ) has been considered for all the thermal design and analysis. 3. Solar Array (SA) The solar arrays are the most exposed part of the TGO to the aerothermal flux. They have not been specifically designed for Aerobraking, but the acceptable flux and energy limit (2800 W/m2, 500 kj/m2) was derived such to not exceed the qualification temperature in worst case condition. In view of the criticality of SA temperature both solar array wings have been specifically instrumented with 12 thermistorss (4 triplets of thermistors at different locations) to ensure monitoring by the Control and by on-board surveillances. 5

6 Special attention was given to the accuracy and repeatability of the repositioning of the Solar arrays back to their required position during Aerobraking to avoid a potential wind mill torque. 4. Propulsion The TGO has the capability to operate its propulsion system in force-free mode. During nominal operations the propulsion system is operated in non force-free mode since during atmospheric passes the delta-v induced by propulsion contributes to the braking. However in safe mode propulsion is operated in force-free mode to limit the impact on the altitude of the thruster activity which would be induced by a safe mode. 5. GNC Sensors Accelerometers. While they are typically used for integrating the delta-v and cutting off the thrust, the accelerometers are mandatory sensors for Aerobraking with multiple usage: monitoring of Aerobraking passes by the Control Centre, on-board estimation of the time of passage, on-board detection of excessive deceleration (e.g. to trigger an altitude raising manoeuvre) The accelerometers are integrated in the Inertial Measurement Unit (IMU) together with the 3 axis gyroscopes. An option with improved resolution and limited acceleration range has been selected. Star Tracker. The layout of the Star trackers avoids nominally aeroflux inside the baffle and towards its optic. B. Software and Autonomy - Fault Detection, Isolation and Recovery (FDIR) To support the Aerobraking GNC mode, specific algorithms and FDIR mechanisms have been developed: 1. A dedicated mode for Aerobraking passes (AEBM : Aerobraking Mode) This mode is a simple deadband control using thrusters (+/- 30 deg deadband). It is complemented by a thrusterbased rate damping sub-mode to ensure smooth return to the normal mode, based on the reaction wheels, after the atmospheric pass. The polynomial guidance remains active during AEBM. The attitude estimation uses gyroscopes only to avoid any risk induced by STR spurious measurement during the pass. The mode was designed for a total propellant consumption (including rate damping) of 10 grams per pass. 2. Capacity of autonomous slew on reaction wheel At the end of the Aerobraking pass the actual attitude is offset from the nominal guidance. To handle that while managing reaction wheel kinetic momentum the normal mode is designed to behave as a rate controller towards the target attitude for large off-pointing, and as a regular attitude control law when close enough to the target attitude. 3. Adaptation of the mode used for safe mode to cope for Aerobraking The TGO safe mode aims to point the TGO X axis towards the Sun, and if star tracker data are available to repoint the high gain antenna towards the Earth. For the Aerobraking phase this logic has been maintained and complemented with a specific sub-mode: While in safe mode, aeropass conditions are detected using a gyro-based torque estimator; when the estimated torque exceeds a threshold a transition is commanded towards a loose rate damping sub-mode, allowing the spacecraft to passively re-orientate towards a stable attitude, and to limit aero-thermal fluxes on critical faces as well as the propellant consumption. After a timeout the safe mode is autonomously reentered. For the rest of the mission the transition to this sub-mode is inhibited. 4. Autonomous pericentre raising manoeuvre The safe mode logic limits the impact of a single Aerobraking pass, however it is necessary to raise as soon as possible the pericentre to limit exposure to flux and allow stable conditions for safe mode recovery, To achieve that, in safe mode, the spacecraft autonomy is designed to trigger at predefined times a preloaded command sequence to realize the delta-v manoeuvre and return to safe mode pointing. 5. An on board estimation of the actual passage at pericentre (Pericentre Time Estimator, PTE) Aerobraking command sequences are uploaded on a regular basis by the Control Centre with a timing based on past orbit determination and atmosphere density prediction. Uncertainty on the Mars atmosphere induces errors on the achieved braking effect and thus growing uncertainties on the actual timing of the following atmospheric passes. 6

7 To limit the time margin required by this pericentre uncertainty, an estimation of the timing of the next passage is done on-board, and the whole command sequence already on-board for further aeropasses is autonomously shifted. The time of passage at pericentre is estimated on-board by a centroid of the accelerometer profile during the pass. The timing of the next pass is estimated using the two last passes estimation and the actual delta-v as measured by accelerometer. The accelerometer bias is also autonomously estimated and compensated. As a protection, safe mode is triggered if the computed total timing shift exceeds a threshold. 6. Specific FDIR monitoring for the passes Although it is not possible to reduce the flux during a given atmospheric pass, the FDIR can detect excessive acceleration (from IMU after filtering) and Solar array temperature during that pass and trigger autonomously a pericentre raising manoeuvre at the next apocentre. The mechanism is similar to the one used in safe mode: A set of manoeuvres time slot is defined by the Control Centre. Upon triggering of one of the aeropass surveillances, a sequence of manoeuvre commands is loaded and executed at the next time slot. Aerobraking operations continue nominally after such a manoeuvre. 7. Capacity for pop-up without STRs The realization of an autonomous pericentre raising manoeuvre as described above supposes that a 3-axis attitude estimation is available on board, requiring valid star tracker data. In case of persistent unavailability of valid star tracker data (for instance during a severe Solar flare), an ultimate mechanism has been implemented to trigger a coarse pericentre raising manoeuvre using IMU information only. This mechanism exploits the fact that the direction of the delta-v imparted by atmosphere around pericentre during a pass is parallel to the direction of the delta-v required to raise it: the IMU maintains the knowledge of an inertial frame using the gyroscopes, estimates the delta-v imparted by the atmosphere in this frame and at a predefined time uses this direction to perform a manoeuvre. C. Specific analysis for Aerobraking studies 1. Aerodynamic and aerothermal analysis To support GNC and system analyses, specific aerodynamic and aerothermal analyses have been performed. The mean molecular path in the atmosphere at Aerobraking altitude is about 1/10 of the TGO span, so free molecular analysis is not sufficient and direct Monte-Carlo simulations were conducted to characterize the aerodynamic database i.e. the aerodynamic force and torque acting on the spacecraft for different orientation with respect to the velocity. These simulations have also been used to characterize the aerothermal fluxes on the TGO external surfaces. Global analysis has been complemented by local analysis to check for any local aerothermal flux concentrations. 2. GNC analyses GNC analyses were classically consisting of large set of sensibility/robustness simulation with a model including aerodynamic modeling. For safe mode these analysis were complemented by a Monte-Carlo analysis to check robustness against initial conditions at aeropass entry. Behavior and robustness of the PTE (Pericentre Time Estimator) were assessed with a specific tool able to chain the passes of the whole Aerobraking phase. D. Testing activities in Industry TGO Aerobraking has been intensively tested in Industry using several means: 1. Matlab/Simulink simulator Preliminary design of Aerobraking Mode (AEBM) GNC mode has been tested through a simplified MATLAB / SIMULINK simulator. Purpose was to verify at first order the functions and algorithms dedicated to attitude control during the Aerobraking phase. 7

8 2. High Fidelity (HiFi) simulator During development phase, a dedicated high fidelity (HiFi) simulator has been built in order to verify the TGO behaviour in a highly representative environment, when using the same software components (GNC modes and functions) as in the TGO CSW. The modelling of the Mars atmosphere is based on EMCD (European Mars Climate Database) which provides a density model with respect to altitude/latitude/longitude/time and also wind, dust storm scenario, etc. The aerodynamic efforts applied to the TGO have been modeled through a set of 2-dimension look-up table representing the force and torque coefficients as a function of angle of attack and side-slip angle. The HiFi simulator has been used for robustness and sensitivity tests campaign, GNC performance mono-mode and multi-mode tests, and also to prepare reference-runs for tests performed on Avionics Test Bench. 3. Avionics Test Bench (ATB) In the core validation phase, two ATBs have been used in order to execute more than hundred tests of the initial Functional Chain Validation campaign. The first ATB was used specifically for TGO Platform tests, whereas the second ATB was used for Payload tests. The second one was moved to Thales Alenia Space Turin to perform coupling and separation tests with EDM ATB, and perform SVTs conducted by the Flight Control Team. The first ATB was left in Thales Alenia Space Cannes as a backup after the launch, and to prepare specific Aerobraking tests. 4. Specific Aerobraking testing activities on ATB Due to the high complexity of the FDIR and specific Aerobraking mechanisms (PTE function, different kinds of popup manoeuvres), a large effort was dedicated to validate the sequence of Aerobraking operations. Providing real hardware in the loop (loading of files in Mass Memory, Safe Guard Memory), the ATB was the adequate tool to reach the highest level of representativeness. A large number of iterations between Industry and the Flight Control / Flight Dynamics teams at ESOC were required to build the final operational procedures for flight. At each iteration, Industry performed several Aerobraking tests on the ATB in order to validate either latest CSW modifications, or latest operational sequences (each time closer to the final sequences), and ensure absence of regression. Very detailed test procedures and test reports were delivered to the Flight Control and Flight Dynamics teams as inputs for Flight Operations Procedures (FOP). During each SVT, freshly updated procedures were executed to observe the behaviour of the new CSW and operational sequence modifications. When an anomaly was detected, a correction was proposed by Industry and a new iteration performed. Final operational sequences for short Aerobraking orbits were validated in mid-2017 during the Solar Conjunction break preceding the second part of the Aerobraking phase. E. Operational Validation 1. Flight Dynamics preparation and validation During ExoMars operations, the Aerobraking was the most complex and demanding phase for the Flight Dynamics team. Preparation started well ahead of this phase. The Flight Dynamics team is composed to handle several subsystems with different responsibilities: 1) Navigation: Responsible for Orbit Determination, atmospheric calibrations, Aerobraking pass and manoeuvre performance analysis. 2) Trajectory design: Responsible for manoeuvre planning to control the Aerobraking corridor. 3) Command generation: Responsible to generate the Flight Dynamics Mission Timeline commands, in order to allow the spacecraft to execute the requested operations. 4) Attitude monitoring: Based on the telemetry from the spacecraft, it is responsible to monitor the status of the spacecraft, analyze the manoeuvre and the performance of each Aerobraking pass. It is also in charge to generate the auxiliary Flight Dynamics products as the Events file (file containing orbit or attitude events for mission planning by the Flight Control Team) or converting the orbit file to the requested format for the external interfaces. 5) Test and Validation: Responsible to validate the operations performed by each of the previous subsystems and prepare the testing campaign. 8

9 The definition of the operational trajectory, coordinated with the mission analysis team, started in 2011 with the definition of the main strategy to control the Aerobraking corridor. In the following years, Flight Dynamics closely worked with the Flight Control Team and Industry to define the operations timeline and the spacecraft commanding within an orbit. Flight Dynamics prepared the tools required to monitor and analyze the spacecraft telemetry during Aerobraking operations and perform orbit determination and atmospheric calibrations, using data from the accelerometers. A dedicated coordination was set up between ESOC-Flight Dynamics and NASA-JPL allowing the support of the JPL Navigation team during the TGO Aerobraking operations. Flight Dynamics participated in several test campaigns on the industrial Avionics Test Bench (ATB) and Simulation campaigns on the ESOC Simulator; moreover, the Flight Dynamics team performed a set of internal simulations, called System Tests. A System Test is an End-to-End simulation campaign involving all subsystems within Flight Dynamics. The scope of these tests was to simulate the Aerobraking commanding cycles during the Walk-in (i.e. period in which several pericentre lowering manoeuvres are executed to gradually decrease the pericentre altitude to slowly enter into the atmosphere). The following steps were performed: 1) Preparation of the spacecraft telemetry, real world orbit and tracking data. 2) Analysis of the Aerobraking passes and manoeuvre performances based on the spacecraft telemetry. 3) Orbit determination and atmosphere calibration. 4) Planning the following pericentre lowering manoeuvre. 5) Mission Timeline commands generation. 6) Generation of the auxiliary Flight Dynamics products. 7) Emulation of the commands to generate spacecraft telemetry. All these steps were repeated several times to simulate the first weeks of the Aerobraking phase. Several testing campaigns were held between the NASA-JPL Navigation team and the ESOC-Flight Dynamics Navigation team to align the operations models and compare orbit determination solutions. Finally, before reaching the period when an autonomous exit from the atmosphere with a Pop-Up Direction Estimator (PUDE) would no longer be reliable, a System Test campaign was held to simulate the contingency operations to command a Pop-up manoeuvre without the availability of the Star trackers (Manual Pop-up). 2. Flight Operations Validation System level validation tests were run by the Flight Control Team to test the operations end-to-end, involving several systems: Avionic Test Bench in Turin, being the most realistic available hardware The HIgh FIdelity simulator provided by Industry to simulate the Mars environment Realistic orbits as predicted in the Flight Dynamic Long Term Planning Flight Operations procedures ESOC Mission Control System with latest database Flight Dynamics products Apart from first short pre-test in 2015, most of the Aerobraking validation campaign was performed after launch, with three slots for a total length of 18 days. The test campaign covered nominal and contingency scenarios, flux reduction manoeuvre, pop-up manoeuvre with STR and with PUDE and Aerobraking-dedicated safe mode recovery. Several issues and possible improvements were identified and resolved before the real operations: 32 observations on the Flight Operations Procedure, 8 on the database, 26 on the Mission Control System and 8 on the spacecraft. The test was also very useful to consolidate the interfaces, mainly in ESOC between Flight Dynamic and the Flight Control Team, and between the ESOC Control Centre and Industry regarding the Industrial support. During Aerobraking, when some quick confidence test was needed, the ESOC software simulator was used. It was set up with an Aerobraking dedicated break-point updated with the latest operational state vectors and attitude, such that the operational products could be used for commanding the simulator. 9

10 III. The Operations A. Overall TGO Aerobraking Corridor Control Strategy over One Year The Aerobraking corridor was defined in a Long Term Planning (LTP) trajectory, which was used as reference during the manoeuvre decision process before generating the commands (Short Term Planning). The LTP trajectory contained the following phases: 1) Walk-in: Period in which several pericentre lowering manoeuvres are executed to gradually decrease the pericentre altitude to slowly enter into the atmosphere. In this period the spacecraft performance is assessed before reaching the Aerobraking regime and to obtain knowledge of the atmosphere. 2) Main phase: During this period, control manoeuvres are optimized every 2 days in order to achieve the maximum Delta-V during the Aerobraking passes without violating the following design parameters: Design value Spacecraft limit Dynamic Pressure < 0.28 Pa 0.7 Pa Heat Flux < 1120 W/m W/m 2 Heat loads < 200 kj/ m kj/ m 2 Target Apocentre altitude 1000 km Minimum Apocentre altitude 350 km Table 1. Trajectory design parameters and spacecraft constraints The aerodynamic design parameters are derived to guarantee the spacecraft safety assuming an increase of the atmospheric density of up to 150 % with respect to the predicted model. 3) End-Game: This is the most critical time close to the end of Aerobraking. As the orbital period is short, the spacecraft performs numerous Aerobraking passes (up to 12 per day), with frequent interruption of the communications. For any non-nominal situation, the spacecraft could perform several Aerobraking passes before the Control Centre can intervene. During this phase, once the orbital period is below 6h, the Aerobraking regime is reduced by about 30% in order to increase robustness against the atmospheric variability. 4) Walk-out: In this period a single pericentre raising manoeuvre is commanded to leave the Aerobraking regime. Although, the spacecraft has autonomy to raise the pericentre altitude in the case of safe mode or increase of the atmospheric density, a survivability requirement of 48h is also applied on the trajectory design. So, each manoeuvre has to guarantee that the design parameters in Table 1 are not violated until the next manoeuvre + 48 h. Figure 2 shows the evolution of the orbital period and pericentre altitude based on the Long Term Planning trajectory. One Planning trajectory was generated before the start of the Aerobraking, however, once operational knowledge was gained, the planning trajectory was updated. 10

11 25 End of 1 st Walk-in No Aerobraking Solar Conjunction End of the 2 nd Walk-in Change of the Aerobraking regime Orbital Period [h] Pericentre altitude [km] 0 03/17 05/17 07/17 09/17 11/17 01/18 Date Period 1st LTP Period 2nd LTP Altitude 1st LTP Altitude 2nd LTP Figure 2. Orbital period and altitude evolution B. Walk-In 1. Principles The most important part of the Walk-in is the decrease of the orbit pericentre from outside the atmosphere to the chosen altitude inside the atmosphere. The selected strategy was a gradual decrease: the first manoeuvre at apocentre (3 to 5 m/s) lowers the pericentre from its starting value of 200 km into the atmosphere at an initial high value with small thermal and pressure loads; the consecutive lowering of the pericentre is achieved through further manoeuvres at apocentre until the peak target dynamic pressure value is reached. This allowed monitoring the spacecraft performance and the atmosphere behaviour at low Aerobraking regime before proceeding to the next step. In coordination with the pericentre lowering, other operations prepared the spacecraft for the Aerobraking phase: definition and/or enabling of specific surveillances; telemetry mode modification to increase visibility of the parameters important during this phase; power and thermal dedicated setting; and setting of the flag that if required mode would configure the spacecraft in the dedicated SAFE-A mode (for Aerobraking) instead of the generic SAFE mode. 2. Execution The first Walk-in phase started on 15th March 2017 and lasted 47 days, with a total of 9 Pericentre Lowering Manoeuvres executed to go from the initial 200 Km to 107 Km. At the beginning of the Walk-in, a weakness of the on-board autonomy for the Pericentre Time Estimator calculation was identified in case a STR re-configuration would occur during the aeropass. As the probability was not negligible, the procedures for the aeropass were modified to avoid any issue. Meanwhile the on-board autonomy remained disabled and the Aerobraking regime kept at a low level resulting in a very low drag. After testing of the modification on the ATB and on the ESOC simulator, it was loaded on board and the Pericentre Time Estimator was authorized on 5th April The second Walk-in, after the break during the Solar Conjunction season, started on 30th August and lasted 17 days, with 6 Pericentre Lowering Manoeuvres. The PTE was authorized already on the 6th September. 100 C. Baseline Operations 1. Overall Organisation The baseline operations were divided in three phases: 11

12 1) Long orbits phase before conjunction, from 15 th March to 26 June ) Long orbits phase after conjunction, from 30 August to 4 th December ) Short orbits phase, from 4th December 2017 to 20th February 2018 During the Solar Conjunction period a new CSW was uploaded. It solved the few issues raised during the last Aerobraking System Validation Test and the start of the Aerobraking operations: 1) Increase robustness when replacing pop-up manoeuvres files already on-board. 2) Avoid PUDE re-initialization at STR swap 3) Avoid Pericentre Time Estimator reset at Aerobraking Mode entry 4) Improve SADM reconfiguration handling 2. Spacecraft Attitude A normal Aerobraking orbit was showing mainly two spacecraftt attitudes: 1) Exo-atmospheric attitude. Around apocentre, the High Gain Antenna is stowed and pointed towards Earth, the Sun is in the XY plane towards X and the solar arrays are in cruise mode (i.e. pointed to Sun). 2) Aerobraking attitude. In the atmosphere, the S/C direction corresponding to the theoretical equilibrium (i.e. about 10 deg nose-up) is aligned with the velocity, the S/C Z axis is perpendicular to the orbital plane, the Nadir direction remains on the S/C -Y side, the Solar arrays in braking position (i.e. back of the panels perpendicular to the flux) and the High Gain Antenna is stowed (see Figure 3). Figure 3 Aerobraking attitude. The part of the orbit with the spacecraft in exo-atmospheric attitude is dedicated to communications: Doppler data are collected for the orbit re-construction, during the no-visibility periods, and thee needed commands are uplinked. 3. Mode Transitions during an Orbit In time before the atmosphere entry point, a Wheel Off-loading is performed and then the guided slew to the Memory dumps are executed to download the spacecraft housekeeping data recorded Aerobraking attitude is started. During the slew also the Solar panels are commanded to the aeropass position. Before entering the atmosphere, when the slew is completed, the spacecraft is commanded into AEBM, the mode for Aerobraking passes. After the pass the Rate Damping sub-mode is entered in preparation for the transition to the nominal mode with wheels (NOMR). 12

13 At NOMR transition, the difference between the next pericentre time estimated by the PTE autonomy and the expected value previously uplinked by ground is calculated: this difference is used to shift all commands in the on- board timeline related to orbit position. The transition to NOMR also marks the start of the slew to the exo-atmospheric attitude. The starting point of the slew is not exactly predictable (because of the loose deadband of the attitude control in AEBM), therefore only the target attitude is provided by ground command and the slew profile decided by an on-board algorithm named LAPID. At the end of the unguided slew, the duration of which could be predicted, the spacecraft was again ready for communication in the exo-atmospheric arc. See Figure 4for the overview of the operations during a nominall orbit without manoeuvres. Figure 4 Typical operations for an Aerobraking orbit. Due to the potentially long duration of the slewss from one attitude to the other, below a certain orbital period there would not have been enough time left for communication.. Therefore a different approach was used: the selected exo-atmospheric attitude was the closest to the Aerobraking attitude during the pass with the Earth inside the pointing domain of the High Gain Antenna. Using HGA steering, this second type of exo-atmospheric for Doppler data collection, commanding uplink and Mass Memory dumps. This strategy was applied after thee solar conjunction (during phase 2 attitude reduced the size of the needed slew and allowed longer communication window and 3). 4. Manoeuvres During the full Aerobraking phase, 67 manoeuvres were executed, 45 to lower the pericentre and 22 to raise it, they included: 1) Walk-in and Walk-out manoeuvres to enter/exit the atmosphere at the beginning/end of the Aerobraking operations and before/after Solar Conjunction; 2) Pericentre control manoeuvres to adjust the pericentre height and consequently the pass drag to keep the planned regime; 3) Manoeuvres driven by collision avoidance exigencies, minimizing collision avoidance risks stemming from orbit crossings of TGO with NASA orbiters and ESA s Mars Express orbiter; 13

14 4) Pericentre raising manoeuvres to lower the Aerobraking regime at the beginning of the short orbit phases. These pericentre control manoeuvres were all executed at apocentre, reducing the communication window on the affected orbits. 5. Communications Rather unusual operational challenges had to be addressed for communication between the Earth ground stations and the TGO: 1) Unknown times of Acquisition Of Signal (AOS) and Loss Of Signal (LOS). AOS and LOS times could not be predicted due to the inaccuracy of the orbit prediction, the on-board autonomous shift of the timeline commands and the unknown duration of the unguided slews. This made impossible the traditional way to support the communication passes, both for ground station configuration and spacecraft controller activities in ESOC. Real time operations for the ground station configuration had to be automated directly from the Mission Control System instead of requested by voice-loop to the ground station operator (at least with ESTRACK stations). For the spacecraft controller, the expected AOS interval and the LOS time were calculated, in real time, using the mission timeline together with the telemetry reporting the last PTE shift value. Tools were developed as stand-alone tools or integrated in the Mission Control System to help the controller. 2) Optimization of the communications windows: as they were limited, and shortening with progress of the Aerobraking phase, an optimization strategy was required. A continuous sweep strategy was applied by the ground station to ensure that, as soon as the first signal arrived on Earth, the spacecraft receiver was already in lock and allowed commanding. 3) Timeliness and integrity of the housekeeping telemetry dump. During the entire Aerobraking phase it was highly critical to receive as soon as possible the full telemetry dump from the spacecraft: the latest, and most fresh data was needed by Flight Dynamics from the beginning of the daily commanding cycle. An onboard monitoring was added on-board to trigger the dump as soon as contact from Earth was confirmed. Procedures and training were created for the controllers to promptly check the dump integrity and react with a re-dump if needed. 4) Guarantee daily critical uplink. Aerobraking commands needed to be uplinked timely every day, routinely or for emergency. The commands could be delivered any time of day or night. Timely reliable uplink was achieved via a robust interface between Flight Dynamics and Flight Control Teams including hand-shake at commands delivery and dedicated uplink procedures for the spacecraft controller. D. FDIR and its tuning Spacecraft autonomy including Fault Detection, Isolation and Recovery (FDIR) is essential for critical operations like Aerobraking, even more with an orbit period down to 2 hours. It is vital to react timely to the contingency situations, the first reaction level being the on-board FDIR. 1. Overview For TGO Aerobraking the FDIR can be divided in three groups: 1) Level-1 FDIR. Triggered upon a contingency with a confined effect, operations can continue but at a lower Aerobraking regime. They initiate the execution of the loaded Flux Reduction Manoeuvre telecommand (TC) file at the next apocentre. 2) Level-2 FDIR. Triggered upon a contingency with a system level effect, operations are compromised and cannot continue. They trigger the Aerobraking SAFE mode and the consequent execution of the pop-up manoeuvre that will interrupt Aerobraking raising the pericentre outside the atmosphere. 3) Utility FDIR. Configurable autonomous reaction triggered upon a nominal event. They trigger routine actions that cannot be programmed at a predictable time but need to be performed as soon as possible after a certain event. 2. Level-1 FDIR Two dedicated ones were used: 1) PMON 106, indirectly monitoring the heat flux during the aeropass via the linear acceleration along the spacecraft X axis. The threshold evolved throughout the phase as the relation between linear acceleration and heat flux depends on the spacecraft velocity, and the heat flux limit was changed adjusting to the 14

15 operations needs: it was generally lower than the design value of 2800 W/m2, to ensure further margin wrt the design constraints, but had to be increased when the trade-off analysis showed that a limited error in the orbit prediction was more critical (e.g. around Phobos orbit crossing). PMON 106 triggered once, as presented in Chapter V section B. 2) PMON 107, indirectly monitoring the heat load during the pass via the solar array temperature. Only the low limit of the monitoring had to be modified before start of Aerobraking: on-board measurement in similar conditions showed that the threshold was not low enough. The limits were set to -250 and +145 degc and never modified. PMON 107 never triggered. 3. Level-2 FDIR Four dedicated ones were used: 1) PMON 108, monitoring the absolute difference between the pericentre times predicted by ground (and stored on-board) vs. the ones estimated on-board by the PTE. This was to ensure that the absolute, nonshifted times of the contingency pop-up manoeuvres were not too far from apocentre and consequently the manoeuvre ineffective. The monitoring limits were modified at each commanding cycle to equate 1/8 of the orbit period. 2) PMON 110, checking that there always was a ground prediction available on-board for the upcoming pericentre time. This would have triggered a SAFE mode if the end of the commanding period had been reached without new commands on-board (i.e. in case of major uplink problems). 3) PMON 111, checking the number of already performed flux reduction manoeuvres. It would have triggered a SAFE mode at the fourth consecutive flux reduction manoeuvre, on the basis that something seriously abnormal must be ongoing with the spacecraft or the atmosphere. 4) PMON 183, defining a non-commanding window that starts after the time-shift of already loaded commands, in order to avoid that commands are shifted to the past. As for PMON 108 the limits were depending on the orbit period. None of the Level-2 FDIR triggered during Aerobraking! 4. Utility FDIR Two dedicated ones were used: 1) PMON 181, re-enabling the attitude FDIR after a time interval (equal to the slew duration) counted from reentering the nominal mode NOMR. This could not be done with time-tag commands since the slew ended during the non-commanding window. 2) PMON 184, starting the dump of the spacecraft recorded telemetry upon detection of the on-board receiver in lock. E. Walk-out - Termination of Aerobraking The Walk-out to terminate Aerobraking was executed in both temporary and final exits with a single manoeuvre raising the pericentre outside the atmosphere to an altitude of 200 km. After confirming successful execution of the manoeuvre, the spacecraft was reconfigured for nominal operations. The first Walk-out was executed as planned on 25th June 2017, to suspend Aerobraking for the Solar Conjunction phase. The second Walk-out was executed once the apocentre reached the target altitude of about 1000 Km, on 20th February 2018 at 17:30z. The exact time was chosen to avoid a further orbit crossing with NASA s Mars Reconnaissance Orbiter. The Walk-out was followed by a manoeuvre campaign of 6 weeks to reach the final science orbit, with a pericentre at 360 Km and an apocentre at 413 Km. 15

16 IV. Lessons Learned A. Aerobraking Performance At each commanding cycle, pericentre control manoeuvres were defined to achieve a Delta-V per Aerobraking pass close to the Long Term Planning trajectory. Other factors such as atmospheric predictions or orbit crossings with other satellites were also taken into account at the time of the manoeuvre decision. 1. Altitude Evolution Figure 5 provides information on the evolution of the Apocentre altitude between the reconstructed trajectory and the planned one. Altitude of the Apocentre /17 05/17 07/17 09/17 11/17 01/18 First LTP Second LTP Reconstructed orbit Figure 5. Apocentre altitude evolution During the first Walk-in it was not possible to follow the evolution of the apocentre altitude as planned. The atmosphere was colder than what the models predicted: the spacecraft encountered less density and further pericentre lowering manoeuvres were required. During the Walk-in, some weaknesses of the spacecraft autonomy were encountered; this delayed the Walk-in operations until workarounds were applied. The nominal Aerobraking regime was achieved at the beginning of May During the following operations, the targeted regime was slightly higher to recover the delay. At the time of the Aerobraking interruption, due to the Solar Conjunction, the apocentre altitude was already lower than the planned one. So, small delays could be accommodated without delaying the end of the Aerobraking. During the second Walk-in, the operational atmospheric models were underestimating the atmospheric density (the scale height used for the exponential model was higher than the observed one). This caused a triggering of a Flux Reduction Manoeuvre on the 19 th September. The manoeuvre raised the pericentre altitude by 3.2 km. This can be observed in Figure 5 as the apocentre altitude evolution decreases faster than the plan until the manoeuvre is triggered. Date Triggering of a Flux Reduction Manoeuvre 16

17 2. Delta-V and Acceleration Evolution along the Phase Figure 6and Figure 7 present the evolution of the delta-v and maximum acceleration measured during each aeropass. Figure 6. Aerobraking performance before conjunction Figure 7. Aerobraking performance after conjunction 17

18 3. Heat Flux The reconstructed heat flux and the threshold used to trigger a Flux Reduction Manoeuvre are represented in Figure 8. Until close to the End-Game, the commanded threshold was low to add further margin with respect to the operational constraint of 2800 W/m 2 (spacecraft limit). However, as during the End Game a Flux Reduction manoeuvre could lead to triggering a Safe Mode due to a too large difference between the ground predicted and onboard estimated pericentre times, the heat flux limit was increased up to the 2800 W/m 2 spacecraft limit Heat flux [W/m^2] /17 05/17 07/17 09/17 11/17 01/18 Heat flux FRM limit 4. Performance Summary The following tables provide a summary on the Aerobraking performances: A/B phase before conjunction A/B phase after conjunction Period 15 th March 2017 to 25 th June th August 2017 to 20 th February 2018 Orbital period reduction 24h to 14h 14h to 2h Number of Walk-in manoeuvres 10 6 Walk-out manoeuvre DeltaV 8.6 m/s 22.5 m/s Average DeltaV per pass 0.8 m/s 1.1 m/s Total DeltaV due to drag 100 m/s 917 m/s Complete Aerobraking phase Total DeltaV due to drag 1017 m/s Total DeltaV due to attitude control 8.7 m/s thrusters during the pass Manoeuvres DeltaV 51 m/s Autonomous manoeuvres triggered 1 Flux Reduction Manoeuvre, 19 th September Number of Aerobraking passes 952 Date Figure 8. Reconstructed Heat flux and FDIR limit for a triggering a Flux Reduction Manoeuvre Table 2. Aerobraking (A/B) performances 18

19 B. Atmospheric models The atmospheric density can be obtained from complex databases as the European Mars Climate Database (EMCD) or the Mars Global Reference Atmospheric Model (Mars-GRAM), or it can be derived using an exponential model based on the following: ρ: Density [kg/m 3 ] h: Altitude [km] ρ 0 : Reference density [kg/m 3 ] h 0 : Altitude where the reference density is taken [km] H: Scale height [km] The European Mars Climate Database was used during the start of the Aerobraking. However, no major benefit was observed against the exponential model; therefore, it was decided to use the latter one for its simplicity. Mars- GRAM was used for comparison, but no special improvement was observed. For long-term studies, the complex models predict better the atmospheric behavior than an exponential one, but for the frequent commanding cycles (up to one every day) the exponential model was accurate enough. A fix exponential model was used and a correction coefficient was applied at each commanding cycle based on the atmospheric observations. The scale height was also updated once, based on the observed data. Ratio [Reconstructed/Predicted] Switch from EMCD to 3.5 exponential model 3.0 Scale height update /17 05/17 07/17 09/17 11/17 01/18 DeltaV ratio Date Heat flux ratio Figure 9. Comparison of the reconstructed and predicted DeltaV and Heat flux C. TGO Behaviour in Aerobraking passes 1. Pericentre Times Estimation Function The on-board mission timeline relies on the Pericentre Time Estimator (PTE) to shift its commands based on estimation of the past and prediction of the future pericentre times. The estimated pericentre time is derived from the centroid of the acceleration during the aeropass. The predicted pericentre time is the computation of the following pericentre passage based on the computed orbital period (from the last 2 estimated pericentres) and the computed Delta-V of the last Aerobraking pass. During the nominal Aerobraking regime, the PTE function always gave results within specifications (difference between estimated pericentre time and reconstructed time afterwards stayed below 240 s); however, a degradation on the estimation and prediction of the pericentre times could be observed in the End-Game. Also for the first Aerobraking passes during the Walk-in the PTE errors were high as the drag levels were very low. Figure 10 shows the difference between ground-reconstructed, most accurate pericentre times from Orbit Determination vs. the PTE predicted times. 19

20 Errors [s] /17 05/17 07/17 09/17 11/17 01/18 Date Estimation error Prediction error Figure 10. PTE estimation and prediction errors The centroid of the acceleration during the atmospheric pass does not fully correspond to the pericentre time due to irregularities in the atmospheric density; also the minimum altitude above the surface might not be the minimum distance to the Mars centre. Combined with the measurement errors, they cause an error on the estimation of the pericentre time, which also affects the prediction of the next pericentre. Furthermore, as the orbit eccentricity decreases, the aeropass becomes longer and the acceleration peak lower for the same Delta-V per pass; the PTE function becomes more sensitive to atmospheric irregularities. Finally, to increase robustness against atmospheric variation, the Aerobraking regime was reduced during the End-Game phase, which further degraded the predicted pericentre times. The evolution of the acceleration during the pass can be observed on Figure 11. Acceleration [mm/s2] Time relative to pericentre [min] Pass#30 Pass #64 Pass#96 Pass#98 Pass #99 Pass #891 Pass #892 Pass #904 Figure 11. Acceleration during the Aerobraking pass 20

21 In order not to propagate any failure of the PTE function to thee autonomous Safe Mode Pop-up manoeuvres or Flux Reduction Manoeuvres, their commands were not shifted by the PTE function. Therefore, to guarantee that the manoeuvres raised the pericentre properly, their Delta-V was sizedd to achieve the target even if they were shifted from the apocentre by up to 1/8 of the orbital period. A surveillance was implemented to trigger a Safe Mode whenever the difference between predicted pericentree time and the one commanded by ground was larger than 1/8 of the orbital period. This was a major constraint during the End-Game. thresholds for the final phase of the Aerobraking. During most of Aerobraking, the threshold was set to a constant value per commanding cycle; during its last month Figuree 12 shows the evolution of this pericentre timing differential (DT PTE) and the corresponding the surveillance threshold was modifiedd for each orbit to increase operations robustness. DT PTE and FDIR [s] DT PTE evolution and FDIR during last month of aerobrakign / /02 07/02 09/02 11/02 13/02 15/02 17/02 19/02 21/02 Date DTE PTE DT PTE FDIR FDIR MIN Figure 12. DT PTE and its FDIRs 2. Thermal and Power Behaviour The power and thermal sub-systemss performed nominally over the full Aerobraking phase. The state of charge of the battery after the aero-pass was around 85% in average, with the minimum values above 70%. The Solar Array temperature peak during the aero-pass reached in few occasions about 20 degree C; the FDIR limit was 145 degree C. An overview of power and thermal performance along the phase is presented in Figure 13. Figure 13. Power and thermal performance overview 21

22 D. Interaction Flight Control / Flight Dynamics 1. Management of Orbital Uncertainty During preparation of the Aerobraking phase, it became clear that due to the uncertainties in the atmospheric density and accordingly in the orbit prediction, the traditional way of getting the full telemetry for an interplanetary mission (memory dumps via pre-loaded commands generated by Mission Planning at precisely predicted times) would not work. With Flight Dynamics delivering every two days (or even daily) updates to the orbit and event predictions, the Flight Control Team would have had to run the heavy Mission Planning process every day, which was not compatible with the manning profile. Therefore, it was agreed that Flight Dynamics would take over some commanding tasks that are normally Flight Control Team responsibility. In particular, stopping the Mass Memory dump when the spacecraft is not visible from Earth had to become part of the routine Flight Dynamics commanding delivery, while the start of the mass memory dump was automated through an on-board monitoring which initiated the downlink of recorded data when the receivers locked up on a ground station uplink for at least 10min. With this setup, the mission planning tasks were reduced to producing (i) the Ground Station commanding schedule, (ii) the Spacecraft Controller guidelines for each contact and (iii) commanding telemetry bit rate changes and a final stop dump at each end of station tracking. Those could be prepared weeks in advance since the timing of booked ground station passes was fixed and independent of the spacecraft position on the orbit. All such predetermined operations were prepared by the Flight Control Team, while commands depending on the spacecraft orbital position were responsibility of Flight Dynamics. The timely uplink of the commanding products generated by Mission Planning or Flight Dynamics commands was under Flight Control Team responsibility. Every day there was one prime and one backup uplink window on two different ground stations; this ensured that the commands would reach the spacecraft even in case of one ground station becoming unavailable. 2. Coordination Briefings To coordinate the commanding, frequent briefings were run with representatives from all ground segment entities (Flight Dynamics, Flight Control, Software Support, Ground Station and Industry support). These briefings initially took place every second day and for short orbits with daily commanding cycles, from December 2017 the briefings were also held daily, including weekends and public holidays. These briefings were key to raise awareness about the spacecraft Aerobraking progress and to highlight the interdependency between each ground segment element. A problem on the ground data systems or the ground stations could have caused a problem in monitoring the spacecraft performance or could have delayed the uplink of the commands. Actually a glitch in the uplink frequency did occur and caused the loss of important GNC housekeeping packets which had to be re-downlinked from the spacecraft before Flight Dynamics started the orbit determination process. E. Ground Stations 1. Station Networks The baseline station support for Aerobraking was two communication passes of 8-hour duration per day, equally spaced over the day; this could be well covered with the ESA network of deep space antennas (ESTRACK 35m). In addition, ESA took into account the Aerobraking experience from NASA JPL and opted for a 24hr per day / 7days per week coverage at orbital periods lower than 6hr. From this point onwards, operations were considered very critical and the additional station coverage fully justified. The 24/7 support could not be completely fulfilled with ESTRACK alone; NASA DSN support was provided in periods when ESTRACK stations were not available due to station upgrade, maintenance or temporary congestion. To accommodate the DSN support, the ground station configuration for Aerobraking was defined and tested with DSN. 2. Dedicated Uplink Strategy A special Aerobraking configuration was implemented which despite of the uncertain AOS/LOS times, ensured maximum availability of a two-way downlink signal for accurate Doppler measurements needed for Navigation. To achieve this the uplink frequency was ramped to compensate for any frequency variations due to Doppler effects; in addition the uplink was permanently swept +/- 10kHz around the Best Lock Frequency whenever the spacecraft was not pointing to Earth (e.g due to an aeropass at pericentre or an orbit control manoeuvre at apocentre). The continuous/cyclic uplink sweep was only stopped when the Control Centre confirmed successful carrier lock on the on-board receiver. At this stage Command Modulation was turned ON and spacecraft commanding could 22

23 commence. When the spacecraft slewed away for the next pericentre or orbit correction manoeuvre, the Command Modulation was stopped and the uplink sweep started again so that the spacecraft could lock up immediately when it turned back to earth-pointing. Figure 14. Uplink Sweep Pattern 3. Commanding Management Commanding was performed every two days at the beginning off Aerobraking. Shortly after the orbital period got below 6 hours, the commanding cycles were increased to daily updates. Each day there were at least 12 hours (spread evenly over two ground stations) in which the commands could be uplinked. At the end of Aerobraking the daily commanding volume reached 5000 TCs uplinked via File Transfer and in some occasions split over two commanding windows. 4. Multiple Strategies An additional challenge came from the major upgrade performed on the ESTRACK deep space stations during the Aerobraking phase. Communication passes weree mainly conducted with New Norcia, still on the established demodulation equipment ( IFMS ) and with Malargüe which transitioned to thee new equipment ( TTCP ). Many tests with different configurations weree performed; different stationn behaviours were experienced, impacting on the spacecraft operations. For instance the uplink sweep on top of the uplink ramping worked well for the TTCP in Malargüe but was in a certain Doppler regime less optimal for the IFMS in New Norcia, requiring a different uplink sweep strategy per ground station. Figure 15 shows the signature of the different uplink strategies from different ground stations on the signal phase error of the TGO receiver. Figure 15. Uplink Strategies 23