r bulletin 100 — december 1999

The Attitude and Orbit Control of XMM

A. ElfvingXMM Project, ESA Directorate for Scientific Programmes,ESTEC, Noordwijk, The Netherlands

The Attitude and Orbit Control Subsystem(AOCS)The AOCS on XMM supports six differentoperational modes, as indicated in Figure 1.The first three acquisition modes aretransitional. The Initial Sun Acquisition mode isused exclusively after XMM’s separation fromthe launcher, to support rate damping, Sunacquisition and solar-array deployment. TheSun Sensor Acquisition mode handlestransitions from the use of the wide-angle SunAcquisition Sensors to the Fine Sun Sensor. Itis also used for recovery from the EmergencySun Acquisition mode (an entirely hardware-supported mode activated by particular failuredetection criteria). Finally the Star TrackerAcquisition mode supports the transition fromgyroscope to star tracker and from thrusters toreaction wheels.

– the high-accuracy inertial pointing– the delta-velocity injection of about 210 m/s– no failure or ground-control error may point

the telescope closer than 15 deg to the Sun– ‘gyro-lean’ operations.

High-accuracy inertial pointingThe high-accuracy attitude information isprovided by a star tracker, co-aligned withXMM’s telescope, giving accurate star-positiondata on up to five stars every 0.5 sec. Inaddition, there is an accurate Sun sensor forprecision Sun-line determination around thetelescope line-of-sight. The sensor informationis processed by the attitude-control computer,on which the operation mode logic and controlalgorithm software is executed. The resultingcontrol demand is achieved by accurate spin-rate control of three extremely well-balancedreaction wheels. Since the telescope must beinertially pointed in all three axes, a so-called‘Sun steering law’ is implemented to compensatefor the orbit progression around the Sun.

Thanks to the low noise in the star-trackermeasurements, a narrow-bandwidth controllerand accurate momentum control of thereaction wheels, the pointing is very stable,being ~1 arcsec over a 2 minute period. Theabsolute accuracy of the reconstructed attitudebased on star-tracker measurements is alsovery high, at typically 1 arcsec.

Slew manoeuvres are used to reorient thetelescope between observations and beforeand after perigee passages. For large slewsoutside the star-tracker field of view of 3 x 4deg, a so-called ‘open-loop slew’ strategy isimplemented. Based on the ground slew tele-commanding, the on-board software generatesa three-axis momentum reference profile and atwo-axis Sun-sensor reference profile. Duringthe slew, a roll and pitch controller is super-imposing momentum correction onto thereference momentum profile, based on theactual Sun-sensor measurements.

Since no absolute measurements are availablefor the yaw axis, a residual yaw attitude error

Attitude and orbit control of the XMM spacecraft relies on twosubsystems on-board: the Attitude and Orbit Control Subsystem(AOCS) and the Reaction Control Subsystem (RCS). Together theymust provide:– stable Sun-pointing after the spacecraft’s separation from the

launcher and during solar-array deployment– increase the spacecraft’s perigee altitude by means of a chemical

propulsion delta-V of about 210 m/s– provide undisturbed, high-accuracy, three-axis pointing during

scientific observations lasting up to 40 h– slew the spacecraft between observations, and before and after

perigee– ensure that the Sun remains more than 15 deg away from the

telescope at all times.

The two main modes for routine operations,described in more detail in the followingparagraphs, are the Inertial Pointing and Slewmode and the Thruster Control Manoeuvremode.

The various units of the AOCS are shown inFigure 2. In addition, it makes use of thepropulsion capabilities of the Reaction ControlSubsystem (RCS), which is described below.

The attitude and orbit control design isinfluenced by four main drivers:

Figure 1. The AOCS operational modes

attitude and orbit control

Figure 2. The constituentunits of the AOCS

r bulletin 100 — december 1999

Figure 3. The constituentunits of the RCS

(courtesy DaimlerChryslerAerospace)

will exist at the end of each slew. The size ofthis error is primarily driven by the uncertainty inthe estimate of the spacecraft yaw inertia, withuncertainties in reaction-wheel inertia andmounting alignment as secondary contributors.For small slews within the field of view of thestar tracker and for the correction of residualopen-loop slew errors, measurements from thestar tracker are used in addition to the Sun-sensor measurements to provide a closed-loopcontrolled slew about all three axes.

At regular intervals, typically twice per orbit, thespin rate of each reaction wheel will have to beadjusted, to avoid ‘near-zero-speed’ operationor speed saturation. The spacecraft is thencommanded into thruster-control manoeuvremode. This mode utilises the Control andActuation Electronics (CAE) to command (in so-called ‘on-modulation’) the four thrusters of thepropulsion subsystem whilst the reaction-wheelspin rates are changed. The minimum-opening-time limitation of the thrusters sets thelimit to the residual spacecraft rates that can becontrolled in this mode. To avoid the reactionwheels saturating in terms of torque, thethrusters are operated in a cross-firing modejust prior to transition to reaction-wheel control.To ensure that the wheels remain within theiroperational range also for ground outages of upto 36 hours, a so-called AutonomousMomentum Dumping (AMD) function isprovided. As soon as the spin rate of a reactionwheel reaches its ‘near-zero’ or ‘near-saturation’ region, appropriate thruster pulsesare fired in ‘open loop’ to restore the spin rateto the nominal region.

Delta-velocity injectionDelta-velocity manoeuvres will have to beperformed at each apogee of the first three orfour orbits of the mission. These are designedto increase the perigee altitude from 850 km inthe injection orbit to 7000 km in the operationalorbit. Also these manoeuvres are supported bythe thruster-controlled manoeuvre mode, buthere the thrusters are commanded in ‘off-modulation’. Nominally all four thrusters arecontinuously firing, providing a total force ofabout 90 N along the telescope axis. Theattitude control is super-imposed on top of thesteady-state firing by means of short closurecommands to individual thrusters. To ensurecontrol stability, there is a smooth ramp-up andramp-down transition between the on- and off-modulation stages.

Protecting against single failuresThe requirement to guarantee that thetelescope never points closer than 15 deg fromthe Sun regardless of any system failure oroperator error is fulfilled by means of three

independent functions (see Fig. 2):– nominal control, implemented around the

attitude control computer (ACC) and a set ofsensors and actuators communicatingthrough a digital bus (MACS)

– failure detection, implemented around thefailure-detection electronics (FDE) and a setof sensors with point-to-point data exchange

– failure correction, implemented around thefailure-correction electronics (FCE) and a setof sensors and actuators with point-to-pointdata exchange.

These three functions are implemented viaindependent hardware and software andcommanded from the ground by independenttelecommands to ensure that any singleanomaly cannot propagate between thefunctions, and thereby ensure the telescope’ssafety. If, for example, a gyroscope used by thenominal control is faulty, the failure detection,which monitors the attitude or rate of thetelescope through a different gyroscope, will incase of danger trigger the failure correction torestore a safe attitude.

‘Gyro-lean’ operationsXMM has four gyroscopes on-board, eachproviding integrated rate measurements abouttwo axes. Apart from during the Launch andEarly Operations Phase (LEOP), which will lastapproximately 10 days, and during eclipses,with a total duration of less than 2% of the totalmission time, the spacecraft will not rely on anygyroscope information. As described above,the slew and on-modulated thruster manoeuvresare carefully designed not to requiregyroscopes. During LEOP and eclipses, twogyroscopes are used for failure detection. Ineclipse, the nominal control uses one channelof these gyroscopes for roll control. Throughout

Y

Liquid Tank(LT)

Fill and Vent Valve (FV)Fill and Drain Valve (FD)

Test Port Valve (TP)

Reaction Control Thruster(RCT)

be a reflection of the dynamic spacecraftmotion under the influence of the actuators. Forthis purpose, a dedicated test environment, the AOCS-SCOE, was constructed whichperforms the following main sequence of tasks40 times per second:– Monitoring of the drive-current requests to

the reaction wheels and the thrusters,signals marked ‘A’ in Figure 2.

– Calculation of the dynamic motion of thespacecraft as a result of these driverequests.

– Translation of this motion into angles andangular rates relevant to each of the differentsensors.

– Electrical stimulation of the respectivesensor electronics, signals marked ‘S’ inFigure 2.

In addition, the test environment developedsupports a powerful test language that enablesrepetitive execution of complex test scenarios.Telecommands can be called-up from theoperational database and the test executionflow can be made dependent on the results ofactual telemetry processing. A version of thistest environment was used by the subsystemcontractor for the subsystem functionverification before delivery to the spacecraft.Figure 4 shows the subsystem tests in progressat Matra Marconi Space (UK) in Bristol with allAOCS flight hardware and flight-representativeharnesses mounted on a test table. Later, asecond version has been used by thespacecraft prime contractor to supportsubsystem integration onto the spacecraft andto verify functional integrity before and aftervarious environmental tests. Finally, the testenvironment has also been extensively used foroperational-procedure validation and to supportSystem Validation Tests conducted by ESOC.

Schedule constraints and achievementsIn line with the original schedule, the total timetaken to design, procure, integrate and verifythe AOCS as a subsystem has been 44months. Three main phases can bedistinguished; subsystem design andengineering-model unit procurement (23months), electrical-model integration andtesting (10 months), and flight-modelintegration and testing (11 months). A total of88 hardware units have been produced,including 30 flight units and three types of unitscontaining a considerable amount of software.

The main challenges in terms of unitprocurement have been to ensure correctinterpretation of the unit specifications, timelyaccess to high-reliability EEE parts, andmaintaining a continuous focus on schedule-critical tasks. Not surprisingly, the electrical-

the mission, two other gyroscopes are availablein cold stand-by to be used by the safe-attitudecontroller in case of identified danger.

For the full mission lifetime of 10 years, theestimated in-orbit operating time for ‘the mostused’ gyroscope is less than 1600 h and 700on/off cycles. Each gyroscope is qualified forwell over 4000 h and 4000 on/off cycles.

The Reaction Control Subsystem (RCS)The RCS is a mono-propellant hydrazinesystem made entirely of titanium and operatedin ‘blow-down’ mode. Its layout, shown inFigure 3, is characterised by four tanks and twobranches, each with four thrusters, a pressuretransducer, a liquid filter and an isolation latchvalve. The tanks have a maximum capacity of530 kg of N2H4 and the fuel expulsion isachieved through surface-tension techniques.Three of the tanks feed their fuel into the fourthmain tank, which acts as the main supplier tothe thrusters. The flow-control valve of eachthruster has dual seats and is self-closing whenelectrical power is removed.

Subsystem verification The functionality of XMM’s AOCS has beenverified by testing at all levels, i.e. unit,subsystem and spacecraft. Performances havebeen verified by testing at unit level and byanalysis and simulation at subsystem andspacecraft level. The operational procedureshave been verified by review at subsystem leveland by testing at spacecraft level.

Functional ‘closed-loop’ testingIn order to test all of the functions of such acomplex control system, there is a need toprovide the sensors with representative stimuli,either electrically or optically. These stimuli must

attitude and orbit control

Z

X

Pressure Transducer(PT)

Liquid Filter(LF)

Latch Valve(LV)

Figure 4. Subsystem testingin progress at Matra

Marconi Space, in Bristol(UK)

model integration phase was characterised by‘debugging’ of the electrical ground-supportequipment (EGSE) to get it operationally stable,and the discovery of a number of short-comings in the on-board software logic.Ultimately, however, the flight-model integrationand testing phase clearly demonstrated thecompleteness of the test coverage andconfirmed the subsystem’s functionality.

Knowledge transfer from design tooperationOne lesson learned is the importance of earlyinvolvement of the ground operations team inthe AOCS design and verification process, andin particular in the development of flightprocedures. The concept of three independentfunctions for nominal operations, for failuredetection and for failure correction relies on theground segment ensuring a context-consistentconfiguration on-board. This is a demandingtask for the ground segment and has been afocal point during the system verification testsand the mission-rehearsal campaign.

The importance of correct, consistent andcomplete documentation must not beunderestimated. In a project of this size, theonly effective means of ensuring adequateknowledge transfer is through properdocumentation. This was particularly so in thiscase because the contractor’s site in Bristolwas closing during the flight-model deliveryphase and access to many key engineers couldnot be maintained. The AOCS and RCS usermanuals, comprising well over 200 documents,have been collected on a dedicated CD-ROMwith full-text retrieval capability. Having all

r bulletin 100 — december 1999 bull

design and procedure documentation ‘to hand’has been essential during the test campaign,and will be no less important during the launchcampaign and LEOP phases.

AcknowledgementThe author would like to extend his gratitude toall personnel in the more than 16 companieswho have contributed to the timely delivery,testing and launch readiness of the AOCS andRCS subsystems for XMM. Without detractingfrom the value of any individual’s contribution, Iwould like to mention a few key colleagues byname: T. Strandberg of Dornier for his infiniteenergy in fulfilling his responsibilities assubsystem manager; A. Kolkmeier of Dornier,W. Holmes of SATASINT, and W. Davis ofCAPTEC for their total, around-the-clockdedication to getting every aspect of the AOCStested; R. Harris, D. Jukes and M. Backler ofMatra Marconi Space (UK) for havingconceived and flawlessly implemented acomplex AOCS within an unprecedented shorttime; P. Henry, P. Chapman and M. Neal ofMatra Marconi Space for their unselfishcontributions in a difficult labour situation; B.Scheurenberg of Dornier for his eagerness toget a good propulsion system delivered ontime; A. Schnorhk of ESTEC for his expertiseand experience in every aspect of thepropulsion system; J. Wohlfart of Dornier andC. Carnevale of Fiat Avio for getting thepropulsion system through the CSG safetyacceptance and safely fuelled; A. Ferretti of FiatAvio for his well thought out propulsion systemdesign and technical supervision of itssuppliers. r