Cluster

E SA’s fleet of four Cluster satellites waslaunched in 2000 to investigate the

nmagnetic interaction between the Sun andEarth. Designed to last 3 years, the mission hasnow been extended to the end of 2009. But thebatteries of the satellites are well beyond theirdesign lives and are starting to fail – the powersituation first became critical during the longeclipses in September 2006. The battery aboardone could not power the heaters or computer, sonew options had to be developed to avoiddangerous low temperatures and to regaincontrol after each eclipse.

The Cluster MissionThe Cluster mission is a critical part ofan international effort to resolvequestions about the Earth’s magneticconnection with the Sun. For 6 years, thefour satellites have been making 3-Dmeasurements of the fine detail in ourmagnetosphere to discover how themagnetic field responds to solar activity.The scientific achievements so far weresummarised in Bulletin #121 (February2005).

Since launch in 2000, the fleet has beencontrolled from the Agency’s EuropeanSpace Operations Centre (ESOC) in

Jürgen Volpp, James Godfrey & Steve FoleyMission Operations Department, Directorate ofOperations and Infrastructure, ESOC,Darmstadt, Germany

Silvia Sangiorgi & Pontus AppelLSE Space Engineering & Operations AG,Darmstadt, Germany

Markus Pietras Department of Mechanical Engineering,Technical University, Darmstadt, Germany

Philippe Escoubet & Horst FiebrichDirectorate of Scientific Programmes, ESTEC,Noordwijk, The Netherlands

Max Schautz & Bernd LehmannDirectorate of Technical and QualityMangement, ESTEC, Noordwijk,The Netherlands

esa bulletin 129 - february 2007 27

Sleeping SatellitesNursing Cluster through Critical Eclipses

Cluster.qxd 2/6/07 11:14 AM Page 26

Cluster

E SA’s fleet of four Cluster satellites waslaunched in 2000 to investigate the

nmagnetic interaction between the Sun andEarth. Designed to last 3 years, the mission hasnow been extended to the end of 2009. But thebatteries of the satellites are well beyond theirdesign lives and are starting to fail – the powersituation first became critical during the longeclipses in September 2006. The battery aboardone could not power the heaters or computer, sonew options had to be developed to avoiddangerous low temperatures and to regaincontrol after each eclipse.

The Cluster MissionThe Cluster mission is a critical part ofan international effort to resolvequestions about the Earth’s magneticconnection with the Sun. For 6 years, thefour satellites have been making 3-Dmeasurements of the fine detail in ourmagnetosphere to discover how themagnetic field responds to solar activity.The scientific achievements so far weresummarised in Bulletin #121 (February2005).

Since launch in 2000, the fleet has beencontrolled from the Agency’s EuropeanSpace Operations Centre (ESOC) in

Jürgen Volpp, James Godfrey & Steve FoleyMission Operations Department, Directorate ofOperations and Infrastructure, ESOC,Darmstadt, Germany

Silvia Sangiorgi & Pontus AppelLSE Space Engineering & Operations AG,Darmstadt, Germany

Markus Pietras Department of Mechanical Engineering,Technical University, Darmstadt, Germany

Philippe Escoubet & Horst FiebrichDirectorate of Scientific Programmes, ESTEC,Noordwijk, The Netherlands

Max Schautz & Bernd LehmannDirectorate of Technical and QualityMangement, ESTEC, Noordwijk,The Netherlands

esa bulletin 129 - february 2007 27

Sleeping SatellitesNursing Cluster through Critical Eclipses

Cluster.qxd 2/6/07 11:14 AM Page 26

Darmstadt (D). Originally planned tolast until 2003, the mission has beenextended twice: into 2005 and then tothe end of 2009, with a review in 2007.Before the second extension wasapproved, the satellites’ health wasanalysed to predict whether they couldreach the new end-date. The mostdifficult conditions occur during longeclipses, when the Earth shadows thepower-generating solar cells. Each year,there are short eclipses of 15–40 minutesaround the orbit’s perigee in March andlong eclipses around apogee inSeptember. The three or four longeclipses each last about 3 hours.

The batteries that power the satellitesduring eclipses are clearly the mostcritical units. It was evident they wouldfail before the end of the extendedmission and that Cluster would have tofind ways to survive eclipses withoutelectrical power. The satellites would bewithout onboard control, the high-power amplifier and propellant pipescould cool too far and the computerwould require recovery after each eclipse.

With 4 years’ operational experience,the Flight Control Team in ESOC wasconfident that the satellites could beoperated during eclipses using only afraction of the power specified by theSpacecraft User Manual. However,there was the concern that, undercertain circumstances, the commanddecoder might not restart correctly afterloss of power. Without the decoder,ESOC’s commands could not be routedto their target units to revive thesatellite.

PreparationsThe Flight Control Team held regulardiscussions with industry and ESTECexperts to come up with newapproaches, and in 2004 a strategy toprolong the battery lives was in action.Meanwhile, the team concentrated onadapting the power, thermal and data-handling operations: individual treatmentof the 20 batteries, warming thesatellites, recovery from all low-powersituations, and rules to allow fastdecisions when necessary.

were brought out of empty storage inSeptember would have been too late.Procedures for all the possible cases hadto be prepared in advance.

New Power ScenariosThe main problem was with Space-craft 1: three of its five batteries hadbeen declared ‘non-operational’. Twohad cracked and one had a suspected‘failed cell’. The energy drawn by thesatellite’s units that cannot be switchedoff was more than could be stored in theremaining batteries. Tests on the threenon-operational batteries, looked for anyway to bring them back to life. Theresults were positive: two could be usedwith some constraints. Even with theseresults, the situation for this satelliteremained critical: one battery non-operational, two requiring precautions,one showing a large internal electricalleakage and the only ‘healthy’ batteryhad low capacity. Altogether, thecapacity was around 12 Ah (4 A for3 hours). This equated to 45 W availablefor the subsystems, whereas 92 W wouldnormally be required during an eclipse,even with the payload, transmitter andall other non-essential units switched off.

The problem was clear: either findways to reduce the consumption to alevel the batteries could handle, or theywould run flat and the satellite wouldshut down, and possibly die. Operatingthe satellite with critical systemsswitched off had never been consideredbefore and it was not covered by eitherthe Spacecraft User Manual orOperating Procedures. It was time tothink ‘outside the box’.

The first step was to switch off thedata recorder and to disable all heaters,

Months before the eclipses, a groundstation plan was prepared to enable real-time contact with the satellites at thestart and end of each eclipse. Extraground stations – Kourou (FrenchGuiana) and the deep space antenna inNew Norcia (Australia) – were preparedfor Cluster.

Working with Ageing BatteriesDuring eclipses, each satellite is poweredby five silver-cadmium batteries. In theearly 1990’s, when Cluster was designed,these were the only non-magneticbatteries available (as Cluster’sinstruments were intended to measuremagnetic fields, the internal fields had tobe minimised). Their short lifetime oftypically 2.5 years is limited by theamount of cadmium, which is graduallydissolved by the aggressive electrolyte.

The lives are also limited by mismatchbetween the individual cells of a batterybuilding up over time. On Cluster, theBattery Realignment Facility reducesthis mismatch by discharging each cellindividually. Monitoring by thecomputer also checks the batteries,preventing over-charging/discharging,which can generate gas.

Since 2004 two strategies have beenused to extend the batteries’ lives: thesatellite temperature has been lowered,slowing the rate that cadmium isdissolving, and all the batteries have

leaving only the computer powered. Thisreduced the average consumption to75 W – still too high.

The only other load that could beswitched off is the computer. The othersare permanently connected to the powerbus. These ‘non-switchable’ loads are themain and redundant receivers anddecoders that handle commands fromESOC, and the power unit, whichconditions, controls and distributes thepower. With the computer off, the powerneeded was finally around the targetvalue of 45 W.

If it turned out before an eclipse thatthe available power would be less than45 W, then only one option remained:disable ‘battery discharge’ after theeclipse began, instantly shutting downthe entire satellite. This ‘power-down’strategy would protect the batteries fromcracking and reserve their energy for useduring the restart after leaving eclipse.

Keeping the Satellite WarmGiven that the power shortage hadserious thermal implications andconsidering the increasing batterydifferences between the satellites,Markus Pietras began studying theproblems for his Masters Thesis atDarmstadt University. The effects ofdifferent heating strategies were studiedusing an existing computer thermalmodel, updated with flight data, and anew model developed for this Thesis.

As the satellite cools down duringeclipse, the most critical items are thetransmitter’s High Power Amplifier(HPA) and the propellant pipes. TheHPA might be damaged if it dropsbelow –30ºC and the oxidiser mightfreeze if the pipes drop below –12ºC.

In sunlight, the solar array generatesmore electrical power than needed forthe instruments and subsystems, so theexcess is used to regulate thetemperature of the Main EquipmentPlatform (MEP). Enough power tomaintain the MEP at about 15ºC isdirected into a network of heaters.During eclipse seasons, more power canbe made available for heating only byswitching off other units.

During eclipses, the HPA andpropellant pipes are protected fromgetting too cold by three heaters thatturn on when the temperatures dropbelow set values. The 80 W drawn bythese heaters is a large burden on theweakened batteries, so in previous yearstheir activation was delayed by pre-heating the spacecraft to 20ºC beforeeach eclipse. The extra power was madeavailable by switching off the HPA andpayload. In 2006, with the batteries ofSpacecraft 1 even weaker, these heaterscould not be used. To prevent thesatellite from getting too cold it neededto be pre-heated to more than 22ºC.

The orbital period of 57 hours allows54 hours between eclipses to charge thebatteries and to warm the satellite. Thesolar arrays do not provide enoughpower for simultaneous heating andcharging, so in the past the batterieswere charged for the first 30 hours aftereclipse, leaving the rest for the heaters toraise the MEP temperature.

By September 2006 several batterieson Spacecraft 1 showed such largeinternal leakage currents that this couldnot be done; a large part of the energy inthe batteries would leak away while theMEP was being heated. Conversely, ifthe satellite were heated during the first24 hours, it would then have 30 hours tocool while the batteries were charging.Another solution was needed!

Propellant Tanks as Thermal CapacitorsWhereas there was no way of storingenough electrical energy, perhaps it

been completely discharged and leftunused for months at a time. Theassociated risks were accepted becausethese measures dramatically reduce therate of deterioration.

By April 2006, 16 of the 20 batterieswere still operational but their capacityhad halved. Three had cracked cells andleaking gas and electrolyte had causedsmall orbit changes. To minimise therisk of further cracking, the perform-ance of all the batteries was beingmonitored individually.

To decide on the approach for eachsatellite it was important to forecastbattery behaviour: how much energycould each store and provide? Themeasurements taken in April after theshort eclipses could not be relied onmonths later for such aged batteries.Measurements taken when the batteries

Science

esa bulletin 129 - february 2007esa bulletin 129 - february 2007 www.esa.intwww.esa.int 2928

Cluster

The projected storage capacities of the Cluster batteries in August2006 compared to the needs for a nominal configuration duringthe longest eclipse of each satellite (3 h 4 min for Spacecraft 1)

Each satellite carries five batteries

The Cluster orbit in September 2006: the satellites are about to enter Earth’s shadow around apogee

Cluster.qxd 2/6/07 11:14 AM Page 28

Darmstadt (D). Originally planned tolast until 2003, the mission has beenextended twice: into 2005 and then tothe end of 2009, with a review in 2007.Before the second extension wasapproved, the satellites’ health wasanalysed to predict whether they couldreach the new end-date. The mostdifficult conditions occur during longeclipses, when the Earth shadows thepower-generating solar cells. Each year,there are short eclipses of 15–40 minutesaround the orbit’s perigee in March andlong eclipses around apogee inSeptember. The three or four longeclipses each last about 3 hours.

The batteries that power the satellitesduring eclipses are clearly the mostcritical units. It was evident they wouldfail before the end of the extendedmission and that Cluster would have tofind ways to survive eclipses withoutelectrical power. The satellites would bewithout onboard control, the high-power amplifier and propellant pipescould cool too far and the computerwould require recovery after each eclipse.

With 4 years’ operational experience,the Flight Control Team in ESOC wasconfident that the satellites could beoperated during eclipses using only afraction of the power specified by theSpacecraft User Manual. However,there was the concern that, undercertain circumstances, the commanddecoder might not restart correctly afterloss of power. Without the decoder,ESOC’s commands could not be routedto their target units to revive thesatellite.

PreparationsThe Flight Control Team held regulardiscussions with industry and ESTECexperts to come up with newapproaches, and in 2004 a strategy toprolong the battery lives was in action.Meanwhile, the team concentrated onadapting the power, thermal and data-handling operations: individual treatmentof the 20 batteries, warming thesatellites, recovery from all low-powersituations, and rules to allow fastdecisions when necessary.

were brought out of empty storage inSeptember would have been too late.Procedures for all the possible cases hadto be prepared in advance.

New Power ScenariosThe main problem was with Space-craft 1: three of its five batteries hadbeen declared ‘non-operational’. Twohad cracked and one had a suspected‘failed cell’. The energy drawn by thesatellite’s units that cannot be switchedoff was more than could be stored in theremaining batteries. Tests on the threenon-operational batteries, looked for anyway to bring them back to life. Theresults were positive: two could be usedwith some constraints. Even with theseresults, the situation for this satelliteremained critical: one battery non-operational, two requiring precautions,one showing a large internal electricalleakage and the only ‘healthy’ batteryhad low capacity. Altogether, thecapacity was around 12 Ah (4 A for3 hours). This equated to 45 W availablefor the subsystems, whereas 92 W wouldnormally be required during an eclipse,even with the payload, transmitter andall other non-essential units switched off.

The problem was clear: either findways to reduce the consumption to alevel the batteries could handle, or theywould run flat and the satellite wouldshut down, and possibly die. Operatingthe satellite with critical systemsswitched off had never been consideredbefore and it was not covered by eitherthe Spacecraft User Manual orOperating Procedures. It was time tothink ‘outside the box’.

The first step was to switch off thedata recorder and to disable all heaters,

Months before the eclipses, a groundstation plan was prepared to enable real-time contact with the satellites at thestart and end of each eclipse. Extraground stations – Kourou (FrenchGuiana) and the deep space antenna inNew Norcia (Australia) – were preparedfor Cluster.

Working with Ageing BatteriesDuring eclipses, each satellite is poweredby five silver-cadmium batteries. In theearly 1990’s, when Cluster was designed,these were the only non-magneticbatteries available (as Cluster’sinstruments were intended to measuremagnetic fields, the internal fields had tobe minimised). Their short lifetime oftypically 2.5 years is limited by theamount of cadmium, which is graduallydissolved by the aggressive electrolyte.

The lives are also limited by mismatchbetween the individual cells of a batterybuilding up over time. On Cluster, theBattery Realignment Facility reducesthis mismatch by discharging each cellindividually. Monitoring by thecomputer also checks the batteries,preventing over-charging/discharging,which can generate gas.

Since 2004 two strategies have beenused to extend the batteries’ lives: thesatellite temperature has been lowered,slowing the rate that cadmium isdissolving, and all the batteries have

leaving only the computer powered. Thisreduced the average consumption to75 W – still too high.

The only other load that could beswitched off is the computer. The othersare permanently connected to the powerbus. These ‘non-switchable’ loads are themain and redundant receivers anddecoders that handle commands fromESOC, and the power unit, whichconditions, controls and distributes thepower. With the computer off, the powerneeded was finally around the targetvalue of 45 W.

If it turned out before an eclipse thatthe available power would be less than45 W, then only one option remained:disable ‘battery discharge’ after theeclipse began, instantly shutting downthe entire satellite. This ‘power-down’strategy would protect the batteries fromcracking and reserve their energy for useduring the restart after leaving eclipse.

Keeping the Satellite WarmGiven that the power shortage hadserious thermal implications andconsidering the increasing batterydifferences between the satellites,Markus Pietras began studying theproblems for his Masters Thesis atDarmstadt University. The effects ofdifferent heating strategies were studiedusing an existing computer thermalmodel, updated with flight data, and anew model developed for this Thesis.

As the satellite cools down duringeclipse, the most critical items are thetransmitter’s High Power Amplifier(HPA) and the propellant pipes. TheHPA might be damaged if it dropsbelow –30ºC and the oxidiser mightfreeze if the pipes drop below –12ºC.

In sunlight, the solar array generatesmore electrical power than needed forthe instruments and subsystems, so theexcess is used to regulate thetemperature of the Main EquipmentPlatform (MEP). Enough power tomaintain the MEP at about 15ºC isdirected into a network of heaters.During eclipse seasons, more power canbe made available for heating only byswitching off other units.

During eclipses, the HPA andpropellant pipes are protected fromgetting too cold by three heaters thatturn on when the temperatures dropbelow set values. The 80 W drawn bythese heaters is a large burden on theweakened batteries, so in previous yearstheir activation was delayed by pre-heating the spacecraft to 20ºC beforeeach eclipse. The extra power was madeavailable by switching off the HPA andpayload. In 2006, with the batteries ofSpacecraft 1 even weaker, these heaterscould not be used. To prevent thesatellite from getting too cold it neededto be pre-heated to more than 22ºC.

The orbital period of 57 hours allows54 hours between eclipses to charge thebatteries and to warm the satellite. Thesolar arrays do not provide enoughpower for simultaneous heating andcharging, so in the past the batterieswere charged for the first 30 hours aftereclipse, leaving the rest for the heaters toraise the MEP temperature.

By September 2006 several batterieson Spacecraft 1 showed such largeinternal leakage currents that this couldnot be done; a large part of the energy inthe batteries would leak away while theMEP was being heated. Conversely, ifthe satellite were heated during the first24 hours, it would then have 30 hours tocool while the batteries were charging.Another solution was needed!

Propellant Tanks as Thermal CapacitorsWhereas there was no way of storingenough electrical energy, perhaps it

been completely discharged and leftunused for months at a time. Theassociated risks were accepted becausethese measures dramatically reduce therate of deterioration.

By April 2006, 16 of the 20 batterieswere still operational but their capacityhad halved. Three had cracked cells andleaking gas and electrolyte had causedsmall orbit changes. To minimise therisk of further cracking, the perform-ance of all the batteries was beingmonitored individually.

To decide on the approach for eachsatellite it was important to forecastbattery behaviour: how much energycould each store and provide? Themeasurements taken in April after theshort eclipses could not be relied onmonths later for such aged batteries.Measurements taken when the batteries

Science

esa bulletin 129 - february 2007esa bulletin 129 - february 2007 www.esa.intwww.esa.int 2928

Cluster

The projected storage capacities of the Cluster batteries in August2006 compared to the needs for a nominal configuration duringthe longest eclipse of each satellite (3 h 4 min for Spacecraft 1)

Each satellite carries five batteries

The Cluster orbit in September 2006: the satellites are about to enter Earth’s shadow around apogee

Cluster.qxd 2/6/07 11:14 AM Page 28

could be done for thermal energy.Previously, pre-heating concentrated onwarming the MEP, but perhaps heatingother ‘thermal masses’ could be a moreeffective way of keeping critical unitswarm.

Each Cluster houses six propellanttanks, weighing 6 kg each and currentlycontaining a total of 50 kg of oxidiserand fuel. The tanks are well insulatedand have 40 W of heaters. The thermalmodels suggested that any heat stored inthe tanks could ‘buffer’ the temperatureof the rest of the satellite.

Tests on the flying satellites wereencouraging: the tanks could be heatedfrom 16ºC to 35ºC in 24 hours and theinsulation was just right to store the heatand release it slowly into the rest of thesatellite during the eclipse. This would beenough to slow the temperature drop ofthe HPA and propellant pipes, keepingthem above their critical temperatures.

Operating Without a ComputerIt was clear that Spacecraft 1’s batterysituation required the decoder-onlyconfiguration. However, given thefragile state of the batteries, the FlightControl Team had to be ready to switchto the power-down option at shortnotice. Even if power-down was notused in 2006, it will be needed some timeas the batteries on all the satellitescontinue to age.

Yet the power levels were not the onlyconsideration when deciding betweenthese options. With the decoder-onlyapproach, all possible loads such as thecomputer are switched off. This is

available battery capacity is 20%greater than required for nominal andheater-off scenarios and 10% greaterthan for the decoder-only option.

– if the battery situation worsens onspacecraft 2, 3 and 4, no attempt willbe made to restart payload operationsbetween eclipses

.These priorities and Flight Rules

superseded those previously laid downin the Spacecraft User Manual andFlight Operation Plan. They wereapproved by the Cluster ProjectManagement shortly before the start ofthe eclipse season.

The uncertainty in the capacityprediction and the need to be prepared forthe worst case meant that new procedureshad to be ready for all three poweroptions (heaters-off, decoder-only andpower-down) on all four satellites. As thenew procedures took shape, they wereapproved by experts and industrialpartners before being tested on theCluster Simulator. The new procedures

against the usual philosophy of ‘safe’spacecraft operations; the commands toturn off the computer were intended tobe used only during ground testing.With the computer off, the batteryvoltages cannot be monitored to preventthem from discharging too deeply. Thisrisks generating gas that could damagethe batteries.

After a power-down eclipse, powercan be restored only when the solararray is illuminated by the Sun as theeclipse ends. The amount of electricitygenerated gradually increases over about15 minutes as the satellites emerges fromthe eclipse penumbra. The decodercircuits were neither designed nor testedto cope with this slow power ‘ramp-up’and the manufacturer was concernedthat they might not restart correctly. Ifboth decoders were affected, the satellitewould no longer be able to processcommands from the ground.

The return of power also triggers theSystem Reconnection Logic (SRL),automatically turning on the computer,activating the batteries and turning onthermostatic heaters. As the satellite iscold, the heaters may try to draw morepower than is available, causing thevoltage to collapse and triggering arestart of the computer. This mightrepeat several times until enough poweris available.

The decoder problem is consideredunlikely, but its consequences would befar more serious than the other potentialproblems. Whenever possible, thedecoder-only option should be used,even if this means operating the

worked well and there was a growing optimism that they would bring the satellites safely through theeclipses. But the true test was still to come.

Eclipse Operations Before each eclipse, the batteries’ latestparameters were compared againstrequirements and the rules were invokedto decide which option should befollowed. In all cases, the batteries werestronger than expected. Spacecraft 2, 3and 4 adopted standard strategies for allthe eclipses. For Spacecraft 1, thedecoder-only option was used, avoidingthe feared command lock-out.

The satellites are separated by10 000 km so did not all experienceeclipses on the same days; fifteen eclipseswere spread across 12 days. The firstorbit saw an eclipse only forSpacecraft 2, the coldest but with thestrongest batteries. The second orbit hadeclipses for #2/3/4. The only day whenall four were eclipsed was 15 September,beginning with #1. The Team was stillrefining and testing procedures on theSimulator right up to this day.

Then, while part of the Team tookcare of the others, a Tiger Teamprepared #1 for its first eclipse. Some30 minutes before it began, they usedhigh-level commands processed by thecomputer to switch off all the satellitesystems one by one, until only thetransmitter and the computer remained.As the computer is required to process

batteries without monitoring. Unlikepower-down, the SRL would not trigger,allowing the Team to choose when andhow to turn on the computer after theeclipse.

The power-down option should beused only if there is not enough batterycapacity to keep even the decoderspowered; the potential restart problemcould not then be avoided anyway. Thiswould prevent over-discharging thebatteries and keep some energy in them.This energy would power the heaterswhen the SRL triggers at eclipse exit,preventing multiple restarts of thecomputer.

Flight Rules and ProceduresIn addition to preparing for all thepossible operating scenarios, the FlightControl Team also needed a set of rulesto decide which to choose for eacheclipse. The priorities for maintainingthe health of the satellites were defined:

Priority 1: maintain power to thedecoders. All other units would bepowered down in preference to losingpower to the whole satellite during aneclipse and thereby risking loss ofcommanding through the decoder.

Priority 2: protect the batteries. Newmonitoring schemes were introducedto ensure that batteries were neitherover-charged nor over-discharged.With the computer off, the batteriescould not be monitored, so batterypredictions should always becalculated with conservative margins.

Priority 3: maintain critical units withinthermal limits. Pre-heating the MEPand propellant tanks should followthe thermal-model predictions. Anyadditional power requires poweringdown the payload and other non-essential units.

These priorities were used to establishthe Flight Rules:

– for any satellite and any eclipse, aparticular strategy should be adoptedonly if there is enough capacity even ifthe weakest battery fails and if the

Science

esa bulletin 129 - february 2007esa bulletin 129 - february 2007 www.esa.intwww.esa.int 3130

Cluster

A simulation shows how warmed propellant tanks raised pipetemperature before an eclipse

The timeline of Cluster eclipses in September 2006. The eclipse durations are indicated (hr:min); 15 September (red) was the only daywhen all four satellites were eclipsed

In the new pre-heating strategy, heat stored in the propellanttanks frees the time for the batteries to be charged close to theeclipse

Spacecraft 1 eclipses. Comparison of the battery capacity needed for the nominal and decoder-only configurations

Critical operations in the Cluster control room

Cluster.qxd 2/6/07 11:14 AM Page 30

could be done for thermal energy.Previously, pre-heating concentrated onwarming the MEP, but perhaps heatingother ‘thermal masses’ could be a moreeffective way of keeping critical unitswarm.

Each Cluster houses six propellanttanks, weighing 6 kg each and currentlycontaining a total of 50 kg of oxidiserand fuel. The tanks are well insulatedand have 40 W of heaters. The thermalmodels suggested that any heat stored inthe tanks could ‘buffer’ the temperatureof the rest of the satellite.

Tests on the flying satellites wereencouraging: the tanks could be heatedfrom 16ºC to 35ºC in 24 hours and theinsulation was just right to store the heatand release it slowly into the rest of thesatellite during the eclipse. This would beenough to slow the temperature drop ofthe HPA and propellant pipes, keepingthem above their critical temperatures.

Operating Without a ComputerIt was clear that Spacecraft 1’s batterysituation required the decoder-onlyconfiguration. However, given thefragile state of the batteries, the FlightControl Team had to be ready to switchto the power-down option at shortnotice. Even if power-down was notused in 2006, it will be needed some timeas the batteries on all the satellitescontinue to age.

Yet the power levels were not the onlyconsideration when deciding betweenthese options. With the decoder-onlyapproach, all possible loads such as thecomputer are switched off. This is

available battery capacity is 20%greater than required for nominal andheater-off scenarios and 10% greaterthan for the decoder-only option.

– if the battery situation worsens onspacecraft 2, 3 and 4, no attempt willbe made to restart payload operationsbetween eclipses

.These priorities and Flight Rules

superseded those previously laid downin the Spacecraft User Manual andFlight Operation Plan. They wereapproved by the Cluster ProjectManagement shortly before the start ofthe eclipse season.

The uncertainty in the capacityprediction and the need to be prepared forthe worst case meant that new procedureshad to be ready for all three poweroptions (heaters-off, decoder-only andpower-down) on all four satellites. As thenew procedures took shape, they wereapproved by experts and industrialpartners before being tested on theCluster Simulator. The new procedures

against the usual philosophy of ‘safe’spacecraft operations; the commands toturn off the computer were intended tobe used only during ground testing.With the computer off, the batteryvoltages cannot be monitored to preventthem from discharging too deeply. Thisrisks generating gas that could damagethe batteries.

After a power-down eclipse, powercan be restored only when the solararray is illuminated by the Sun as theeclipse ends. The amount of electricitygenerated gradually increases over about15 minutes as the satellites emerges fromthe eclipse penumbra. The decodercircuits were neither designed nor testedto cope with this slow power ‘ramp-up’and the manufacturer was concernedthat they might not restart correctly. Ifboth decoders were affected, the satellitewould no longer be able to processcommands from the ground.

The return of power also triggers theSystem Reconnection Logic (SRL),automatically turning on the computer,activating the batteries and turning onthermostatic heaters. As the satellite iscold, the heaters may try to draw morepower than is available, causing thevoltage to collapse and triggering arestart of the computer. This mightrepeat several times until enough poweris available.

The decoder problem is consideredunlikely, but its consequences would befar more serious than the other potentialproblems. Whenever possible, thedecoder-only option should be used,even if this means operating the

worked well and there was a growing optimism that they would bring the satellites safely through theeclipses. But the true test was still to come.

Eclipse Operations Before each eclipse, the batteries’ latestparameters were compared againstrequirements and the rules were invokedto decide which option should befollowed. In all cases, the batteries werestronger than expected. Spacecraft 2, 3and 4 adopted standard strategies for allthe eclipses. For Spacecraft 1, thedecoder-only option was used, avoidingthe feared command lock-out.

The satellites are separated by10 000 km so did not all experienceeclipses on the same days; fifteen eclipseswere spread across 12 days. The firstorbit saw an eclipse only forSpacecraft 2, the coldest but with thestrongest batteries. The second orbit hadeclipses for #2/3/4. The only day whenall four were eclipsed was 15 September,beginning with #1. The Team was stillrefining and testing procedures on theSimulator right up to this day.

Then, while part of the Team tookcare of the others, a Tiger Teamprepared #1 for its first eclipse. Some30 minutes before it began, they usedhigh-level commands processed by thecomputer to switch off all the satellitesystems one by one, until only thetransmitter and the computer remained.As the computer is required to process

batteries without monitoring. Unlikepower-down, the SRL would not trigger,allowing the Team to choose when andhow to turn on the computer after theeclipse.

The power-down option should beused only if there is not enough batterycapacity to keep even the decoderspowered; the potential restart problemcould not then be avoided anyway. Thiswould prevent over-discharging thebatteries and keep some energy in them.This energy would power the heaterswhen the SRL triggers at eclipse exit,preventing multiple restarts of thecomputer.

Flight Rules and ProceduresIn addition to preparing for all thepossible operating scenarios, the FlightControl Team also needed a set of rulesto decide which to choose for eacheclipse. The priorities for maintainingthe health of the satellites were defined:

Priority 1: maintain power to thedecoders. All other units would bepowered down in preference to losingpower to the whole satellite during aneclipse and thereby risking loss ofcommanding through the decoder.

Priority 2: protect the batteries. Newmonitoring schemes were introducedto ensure that batteries were neitherover-charged nor over-discharged.With the computer off, the batteriescould not be monitored, so batterypredictions should always becalculated with conservative margins.

Priority 3: maintain critical units withinthermal limits. Pre-heating the MEPand propellant tanks should followthe thermal-model predictions. Anyadditional power requires poweringdown the payload and other non-essential units.

These priorities were used to establishthe Flight Rules:

– for any satellite and any eclipse, aparticular strategy should be adoptedonly if there is enough capacity even ifthe weakest battery fails and if the

Science

esa bulletin 129 - february 2007esa bulletin 129 - february 2007 www.esa.intwww.esa.int 3130

Cluster

A simulation shows how warmed propellant tanks raised pipetemperature before an eclipse

The timeline of Cluster eclipses in September 2006. The eclipse durations are indicated (hr:min); 15 September (red) was the only daywhen all four satellites were eclipsed

In the new pre-heating strategy, heat stored in the propellanttanks frees the time for the batteries to be charged close to theeclipse

Spacecraft 1 eclipses. Comparison of the battery capacity needed for the nominal and decoder-only configurations

Critical operations in the Cluster control room

Cluster.qxd 2/6/07 11:14 AM Page 30

the commands to turn off thetransmitter, it was left until last. Bythen, of course, the transmitter was offand all signals from the satellite hadceased. Then, although it contradictsaccepted practice, the low-levelcommands to turn off the computerwere sent in the blind, with no way ofconfirming that the commands had beenexecuted. These commands were distri-buted directly to the power switches anddid not need to be processed by thecomputer. Spacecraft 1 was now in‘sleep mode’, ready to enter the Earth’sshadow a few minutes later.

After 2.5 hours, as Spacecraft 1 exitedthe eclipse, it was time to switch on thecomputer and recover the satellite. Thelow-level commands to turn on thecomputer were sent, again in the blind.Allowing time for the computer to boot,the high-level commands were sent aminute later to turn on the transmitter.

A few more nail-biting seconds and analarm sounded on the control system – asignal from the satellite, woken from itshibernation!

But there was no time to relax. Theteam had only 2 hours’ contact time torestore the satellite to its normalconfiguration and load the commandsto prepare for the next eclipse. Some50 hours later, the operation wasrepeated for the second eclipse and thenagain for the third, until finally the mostcritical and stressful operations sinceCluster’s launch were completed!

Although the focus was onSpacecraft 1, the team also managed theeclipses for the other three. Fortunately,they behaved as predicted and there wasno need to resort to the special strategies.

ConclusionWith the pre-heating, none of thesatellites’ units reached critical

temperatures. In fact, the effect of usingthe tanks as heat stores was greater thanexpected: the temperatures at eclipse exitwere above expectation.

The groundwork was also laid forfuture eclipse operations:– a new strategy for heating the satellites

was developed and validated;– the decoder-only configuration was

validated;– the procedures for the power-down

scenario are ready for use if they areever needed.One major uncertainty remains with

the command decoders – will theyfunction after a power-down eclipse?The answer will come in September 2007when the worsening situation willdemand that approach.

The overall problem was simple: reducethe power consumption in eclipses towhat could be supported by the reducedbattery capacity. The resolution howeverrequired a multi-faceted approach froman international, multi-institution teaminvolving the Flight Control Team atESOC and experts from ESTEC andindustry. They identified the critical areas,discovered hidden design margins andconceived new ways of operating thesatellites. Through this team effort, theCluster fleet survived the long eclipsesunscathed to continue their valuablescientific mission.

AcknowledgementsThe authors thank the experts whocontributed to the discussions and thedevelopment of new strategies, drawingon their knowledge from the Clusterdesign, integration and test phases:G. Lautenschläger and H. Sondermann(Astrium), and T. Aielli (AAS-I Laben).The time-critical operations during theintensive eclipse season would not havebeen successful without the excellentsupport provided by the ESTRACKoperations teams at ESOC and theground stations and the dedication of theentire Cluster Flight Control Team. e

Science

esa bulletin 129 - february 2007 www.esa.int32

Further information on Cluster and its mission can befound at http://sci.esa.int/cluster

Top view of Spacecraft 1, with the temperature plots of the most critical units during the 3 h 4 min eclipse of 18 September 2006

Cluster.qxd 2/6/07 11:14 AM Page 32