the envisat satellite and its integration

r bulletin 106 — june 2001

26

The Envisat Satellite and Its Integration

P.A. Dubock, F. SpotoEnvisat Programme, ESA Directorate of Earth and Environment Monitoring fromSpace, ESTEC, Noordwijk, The Netherlands

J. Simpson, D. SpencerAstrium Ltd., Bristol, UK

E. Schutte & H. SontagAstrium GmbH, Friedrichshafen, Germany

IntroductionEnvisat is the largest and most complex free-flying satellite ever built in Europe. It will carry acomprehensive series of instruments designedto observe a whole series of interrelatedphenomena that characterise the behaviour ofthe Earth’s environment as a system. Thesatellite, together with its related groundsystems, will continue and extend the dataservices provided by the Agency’s earlier ERS-1 and ERS-2 satellites. In particular, Envisatshould substantially increase our knowledge ofthe factors determining our environment. It willmake a significant contribution to environmentalstudies, notably in the areas of atmosphericchemistry and ocean studies, including marinebiology.

The observations made by Envisat willeventually be continued and extended by aseries of new, smaller satellite programmesbeing initiated within the Agency’s EarthObservation Envelope and Earth WatchProgrammes.

Background The Columbus Programme approved at theESA Ministerial Council Meeting in The Haguein 1987 included the development of a multi-mission Polar Platform as part of theInternational Space Station. Following a seriesof studies and iterations with potential users, animplementation re-using the equipment andarchitecture of the Spot-4 spacecraft busdesign, although with a significantly enlargedstructure, was decided upon. The maindevelopment phase (Phase-C/D) for the PolarPlatform programme was awarded to BritishAerospace in Bristol (UK) – later to becomeMatra Marconi and now Astrium Ltd. – in late1990.

Meanwhile, in the Earth Observation area, theAgency was considering, as ERS-1 grew closerto launch, how to continue and extend theservices offered. In 1988, these elements weredrawn together in an ESA proposal to itsMember States for an overall ‘Strategy for EarthObservation’. These considerations led to theadoption of the POEM-1 programme, using thePolar Platform, at the Ministerial CouncilMeeting in Munich in November 1991. Therecontinued to be an evolution in the payloadcomplement for POEM-1. This culminated in asplitting of the payload into separate Envisatand MetOp satellites, which was finally agreedat the next Ministerial Council in Granada inNovember 1992. A Phase-C/D contract for theprocurement and support of the Envisatpayload (the so-called ‘Mission Prime Contract’)was awarded to Dornier Satellitensystem, nowAstrium GmbH, in July 1992.

For the early years of this new millennium, Envisat is ESA’s majorcontribution to the study of the Earth as a system. Carrying tensophisticated instruments – both optical and radar – it is the largestand most complex satellite ever built in Europe. It has been designedand tested over a period of more than 10 years. Much of theintegration and test programme was conducted on site at ESTEC, inNoordwijk (NL). It will be the first satellite launched into a polar orbitby Ariane-5.

This article summarises the design and engineering of Envisat, andexplains the model philosophy and test approaches used. The launchcampaign plans are also briefly described.

The satellite makes use of the multi-missioncapability of the Polar Platform originated in the Agency’s Columbus Programme. Thisdevelopment also forms the basis for MetOp.The Polar Platform in turn has drawn heavily onthe equipment and technologies developedwithin the framework of the French Spotprogramme. Almost all of the instruments onthe satellite have been specifically developedfor Envisat, with one or two having a strongdesign heritage from ERS.

DUBOCK 25-06-2001 09:04 Page 2

the envisat satellite and its integration

27

As a result of the programmatic origin of thesatellite, there remain two large contracts for itsimplementation:– the Polar Platform Prime Contract (Astrium

Ltd.), and– the Mission Prime Contract (Astrium GmbH).

These two large contracts, interfacing witheach other at some of the technically mostcritical on-board locations, caused a number ofproblems during the development programme.The satellite integration programme has,however, largely been carried out at ESTECfollowing the closure of Astrium’s Bristol site. Asa result, many of the technical personnel havebeen collocated (with ESA) at ESTEC. This, andthe grouping of both contractors within theAstrium company, has ensured a muchsmoother technical path for the programme inits final phase.

The organisation of the Agency’s project teamsinitially also reflected the programmatic split,with separate project divisions for PolarPlatform and payload. More recently the projectteams have been merged within a singledivision. This too has simplified the technicalconduct of the programme.

Major capabilitiesThe satellite is designed for a Sun-synchronouspolar orbit (Table 1). The planned operatingaltitude is 800 km, although a range of altitudescan be selected allowing variations in therepeat cycle of the ground track. The local timeat the equator for the descending node hasbeen selected as 10.00 a.m., which optimisesillumination conditions for part of the opticalpayload.

The selected orbit has a repeat cycle of 35days and an orbital period of 100.6 min. Itsinclination is 98.54 deg, which implies small,uncovered areas at the poles for instrumentswith limited swath widths. The on-boardsystems allow the ground track to bemaintained within 1 km and the local hour towithin 5 min. One of the on-board instruments(DORIS), when used in conjunction with adedicated set of ground stations, provides real-time knowledge of position to within 50 cm,and a precision altitude restitution to within 5cm.

In nominal operations, the satellite is pointedusing star trackers in a ‘stellar yaw-steeringmode’. In this mode, the satellite is yawed tocompensate for the apparent motion of theEarth across-track beneath the satellite. Thiscompensation simplifies the processing ofDoppler signals from the synthetic-apertureradar. When using the star trackers, random

pointing errors will be less than 0.0085 deg,and the stability over all periods of up to 170 s better than 0.015 deg. Attitudeestimation will be better than 0.04 deg. Thispointing performance allows both adequategeographical location for data measured on theEarth’s surface, and a vertical resolution whenviewing the atmosphere at the limb of betterthan 3 km.

The satellite provides an average of 1900 W forinstrument operations through sunlit andeclipse portions of the orbit. This enables allinstruments except MERIS and ASAR to beoperated continuously throughout the entireorbit. MERIS, the Medium-Resolution ImagingSpectrometer, requires sunlight to operate.ASAR, the Advanced Synthetic-ApertureRadar, produces such enormous quantities ofdata in its high-resolution mode that itsoperation is limited to 30 min per orbit.

The data-handling capabilities of the spacecrafthave also been sized to support the global andregional missions. All instruments exceptMERIS and ASAR operate continuously,together producing 4.6 Mbps. There areseparate additional regional missions forMERIS (up to 25 Mbps) and ASAR (up to 100Mbps). On-board storage in redundant solid-state recorders allows the recording anddumping of all data from the global and regionalmissions. Data can be downlinked directlywhen overflying a suitable ground station, suchas Kiruna in Sweden, via a fixed X-bandantenna, or when within visibility of Artemis, viaa steerable Ka-band antenna.

Command and control of the satellite andpayload is via an S-band transponder. Thesatellite will normally be operated by uplinking a24-hour command timeline. Housekeeping

Table 1. Major capabilities of Envisat

• Sun-synchronous orbit: 800 km, 10 a.m. descending node, 35-day repeat cycle

• Stellar yaw steering, for accurate pointing and Doppler compensation of SAR

• 1900 Watts, 2500 kg for instruments

• Data recovery at up to 100 Mbps direct via X-band or via Artemis

• On-board storage in solid-state recorders for regional and global missions

• S-band command and control; 2 kbps uplink, 4 kbps downlink

DUBOCK 25-06-2001 09:04 Page 3

Figure 1. The EnvisatService Module being

readied for shock testing inthe ESTEC facilities


28

The SM includes eight batteries, and the solararray. This is a flat-pack array designed for thePolar Platform by Fokker Space (NL), based ontheir standard design elements. Once deployed,the array is rotated to point continuously towardsthe Sun using a solar-array drive mechanism,which is attached to the base of the central cone.

The propulsion module on top of the conecontains four tanks, which hold 300 kg ofhydrazine.

A single central computer containing bothcommand and control and AOCS functionsperforms on-board data management. Itcontrols the SM equipment via a standard on-board data-handling bus. The central computeralso communicates with the central computerof the PLM via the same bus.

Payload ModuleThe PLM (Fig. 2) provides the physicalaccommodation for the instruments, as well asa range of instrument-related services, such aspower switching, integrated payload commandand control, data storage and downlinking. Inaddition, some equipment that would logicallybe part of the Service Module is physicallylocated on the PLM for performance reasons.Such equipment includes the star sensors, thegyroscopes, and some of the thrusters.

Within the Earth-pointing and side compartmentsof the PLM is the Payload Equipment Bay(PEB), which contains both payload-supportand instrument equipment. Astrium GmbH isthe subcontractor responsible for the provisionof the PEB equipment for the Polar Platform,and the design of this subassembly is based ontheir experience with ERS-1 and ERS-2.

Measurement data generated by theinstruments is processed by a High-SpeedMultiplexer (HSM) for recording or transmissiondirect to ground. Low-rate data (0 – 32 Mbps)are routed from the instruments to the HSM tocreate data streams that are passed to therecorders or to the Encoding and SwitchingUnit (ESU) prior to transmission. The high-rate(100 Mbps) data from the ASAR in Image Modeis introduced directly to the ESU and modulatesthe two 50 Mbps channels of the downlink.

Each of the two redundant Solid-StateRecorders can be flexibly used tosimultaneously store data from the globalcomposite at 4.6 Mbps and from the regionalmissions. The communications subsystem forthe transmission of instrument data orhousekeeping telemetry comprises an X-bandlink direct to ground and a unidirectional Ka-band link via Artemis.

data is available in real time when over aground station, but is also included in the globalmission data stream.

The satellite is designed for launch only byAriane-5. It has a total launch mass of 8100 kg,of which 2150 kg are instruments. The physicalsize of the spacecraft requires the Ariane-5long fairing, for which Envisat is the firstcustomer.

Major componentsThe satellite is made up of two major sub-assemblies, the Service Module (SM) and thePayload Module (PLM), with a simple structural,electrical and avionics interface between them.All instruments are physically located on thePLM, to which the instruments have a largelystandardised interface. The modularity of thedesign has made it possible to conduct by farthe majority of the integration work on the SM,PLM and instruments in parallel.

Service ModuleThe SM provides the standard satellite supportfunctions, and was subcontracted to AstriumSAS. It is based on the design of the Spot Mk-II service module, but with a number ofimportant new developments, particularly in thestructure and solar-array areas (Fig. 1).

DUBOCK 25-06-2001 09:05 Page 4

Figure 2. The EnvisatPayload Module on thepayload integration stand at ESTEC


29

InstrumentsThe roles and functions of each of the Envisatinstruments are described elsewhere in thisissue of the Bulletin, but some information ontheir accommodation is relevant to anunderstanding of the satellite as a whole.

There are a total of ten instruments embarkedon the satellite, although one of them, the LaserRetro Reflector, is entirely passive. Two others,DORIS and the Microwave Radiometer, share asingle Instrument Control Unit and are operated

as though they were a single instrument. Tables2 and 3 list the instruments, together with their primary mass and power requirements.Figure 3 shows how the instruments areaccommodated on the deployed spacecraft.

Instrument procurement was via one of tworoutes. Instrument sub-contractors, working forthe Mission Prime Contractor, designed andbuilt the so-called ‘ESA-Designed Instruments’(EDIs). A further three instruments wereprovided directly by national funding agencies

Table 3. Announcement of Opportunity instruments

SCIAMACHY Scanning Imaging Absorption Spectrometer for 201 kg 121 W Atmospheric Cartography

DORIS Doppler Orbitography and Radio-positioning Integrated 85 kg 34 Wby Satellite

AATSR Advanced Along-Track Scanning Radiometer 108 kg 94 W

Table 2. ESA-developed instruments

ASAR Advanced Synthetic-Aperture Radar 817 kg 1400 W (max)

RA-2 Radar Altimeter 110 kg 118 W

MWR Microwave Radiometer 24 kg 22 W

GOMOS Global Ozone Monitoring by Occultation of Stars 164 kg 157 W

MIPAS Michelson Interferometer for Passive Atmospheric Sounding 327 kg 196 W

MERIS Medium-Resolution Imaging Spectrometer 209 kg 110 W

LR Laser Retro Reflector 2 kg Passive

DUBOCK 25-06-2001 09:05 Page 5

Figure 4. The majorspacecraft campaigns


30

instruments are thermally decoupled from thePayload Module. Some units of RA-2, GOMOSand ASAR are mounted inside the PEB andshare its thermal control.

Each instrument has a dedicated InstrumentControl Unit (ICU) that interfaces to the PayloadModule Computer (PMC) via a standardisedavionics interface. The ICU is responsible forexecuting the macro commands sent from thePMC as their time tags become due.

for integration with the Polar Platform. Theseare the so-called ‘Announcement of OpportunityInstruments’ (AOIs). The Mission PrimeContractor provided engineering and integrationsupport for the AOIs.

With three exceptions, instruments aremounted entirely on the outside of the payloadstructure. This allows them maximum flexibilityin terms of fields of view, both for observationand for thermal reasons. Externally mounted

AATSR MWR DORIS

LRR

RA-2 ANTENNA

GOMOS

MERISMIPAS

ASAR ANTENNAFigure 3. The flight

configuration of the Envisatinstruments; the

SCIAMACHY instrument isbehind AATSR

DUBOCK 25-06-2001 09:05 Page 6

Figure 5. The solar arrayunder test at Fokker (NL)


31

As a general principle, instruments wereintegrated, qualified and acceptance tested asa unit before delivery for integration with thePolar Platform.

Development programmeModel philosophyThe general philosophy for the satellite hasbeen to use three models:– A structural model for mechanical qualification,

including static-load, modal-survey, shock,acoustic and sine testing.

– An engineering model for electricalcompatibility testing, for preliminary operabilitydemonstration, for debugging ground-supportequipment, and for a preliminary demonstrationof RF compatibility.

– A flight model for thermal-balance and thermal-vacuum testing, for acceptance acoustic andsine and qualification shock testing, for RF-compatibility acceptance and for conclusivedemonstration of operability.

The duration of each of the major campaignsand their relationship to the programme reviewsis shown in Figure 4.

This simple model philosophy was modified insignificant ways as a result of the historicaldevelopment of the programme. Table 4 liststhe models built of each of the major satelliteitems.

An RF mock-up of the entire spacecraft wasbuilt at a very early stage in the programme toallow the measurement of likely couplingfactors between transmitting and receivingantennas.

Since the electrical design of the ServiceModule was so similar to that of Spot, only twomodels of the Service Module were made: astructural model and the flight model.

For the solar array (Fig. 5), there was only onecomplete model, the flight model. In order toavoid overstressing, it was accepted togetherwith the flight-model spacecraft. A single paneltook part in the structural-model satellitecampaigns. The majority of qualification wascarried out at component level.

The instrument development programmesbegan nearly two years after the Polar Platformdevelopment programme. Consequently, anumber of instrument suppliers had difficultymeeting need dates for full engineering-modelinstruments. In these cases simplified

Table 4. Component model characteristics

Component Heritage StM EM FM Remarks

Service Module Spot avionics Yes No Yes EM SatelliteNew mechanics programme with FM

service Module

Payload Carrier New Yes Form and Yes FM refurbished STM fit only structure

Payload New (ERS) Mass Yes YesEquipment Bay Dummies

Solar Array Fokker product One panel only No Yes

Ka-band New Partly Yes YesAssembly

DUBOCK 25-06-2001 09:05 Page 7


32

tasks in a cyclical manner where different tasksmight be executed with different frequencies.

The development and validation of this softwarehas been performed using development andvalidation platforms implementing a fullyrepresentative processor breadboard connectedto a simulated environment modelling accuratelyall of the processor’s interactions with itsenvironment.

Most of the Envisat onboard software is eitherlocated in PROM and downloaded to RAM(e.g. most instrument software), or alreadyloaded in RAM (in the case of the PMC). Inmost cases, software components are loadableand patchable by ground telecommands. Tosupport this, the Flight Operation Segment at ESOC is equipped with a SoftwareMaintenance Facility where software ismodified, tests of the modified software arerun, differences between the memory imagesextracted, and patch commands generated foruplinking. After uplinking, the updated memoryis dumped for a final comparison within thesoftware maintenance facilities.

There were difficulties associated with the initialdesign of the PMC software. Requirementsstemming from the original Columbus multi-mission capability were never descoped to thespecifics of the Envisat mission. At the sametime, the separation between Mission Primeand Polar Platform Prime Contractors meantthat proper requirements on mission operability

instrument models were supplied sufficient forthe real needs of the engineering-modelsatellite programme. In a number of cases, thisallowed the instrument supplier to continuedevelopment work on a full engineering-modelinstrument, to the eventual benefit of the flightmodel. Table 5 lists the development modelsfor each of the instruments.

The optics modules of SCIAMACHY andMIPAS were replaced during the flight-modelthermal test with thermally representativemodels.

Satellite software development and validationapproach Envisat carries some 40 different real-time processors and a wide range of thesatellite’s functions are software-implemented:commanding and monitoring of SM, PEB andpayload-instrument equipment, payloadscience data-handling functions, onboard timedistribution and datation, and scientific dataprocessing (in the case of the AOCS and ofseveral payload instruments).

In general, these computers have used Ada asthe programming language (e.g. the forPayload Module Computer), or Assemblerwhen tight memory resources forced thedesigner to optimise the size of the code for agiven function (e.g. for the Service ModuleCentral Communication Unit). Most processorsbelong to the 1750 family (standard instructionset). The software is designed to schedule

Table 5. Instrument-model characteristics

Instrument Development StM EM FM RemarkCategory

ASAR New Antenna Reduced EM FM 4 active tiles for EM

GOMOS New No Full EM FM Reduced EM to serve spacecraft EM

MERIS New Yes Reduced EM FM 1 out of 5 cameras (EM)

MIPAS New Yes Full EM FM Reduced EM to serve spacecraft EM

MWR Rebuild No No EM FM ERS-based instrument

RA-2 Partially new No Full EM FM ERS-based instrument

LR Rebuild No No EM FM ERS-based passive optical system

AATSR Partially new No Reduced EM FM ERS-based instrument

DORIS Rebuild No Full EM FM EM available for spacecraftRFC test

SCIAMACHY New Yes Reduced EM FM Reduced EM to serve spacecraft EM

DUBOCK 25-06-2001 09:05 Page 8


33

were not levied on the PMC. These difficultiesco-existed with a decision to use Ada on thelate 1980s Mil Std 1750 processor the MAS281.This situation led to late softwaremodifications and additional validation effort.An independent company was contracted toperform additional intensive testing using fouradditional software-validation facilities. System-level schedule impacts were limited by tuningthe scope of system tests to match successiveand incremental deliveries of the PMC softwarefor satellite Assembly, Integration and Testing(AIT). A mission time-line test simulating fiveconsecutive orbits of intense satellite operationwas successfully run in December 2000. Thefinal version of the PMC software is currentlycompleting non-regression testing.

System databases supporting in-orbit satelliteoperationsTwo main database products have beendelivered to support Envisat in-orbit operations:– The Satellite Reference Database (SRDB)

has been delivered by the Prime Contractorto ESOC to conduct in-orbit operations. Itgathers together lower-level databasesinitially used within the various EGSEs, andensures uniqueness of each parameterthrough a well-controlled nomenclature. Thedatabase as delivered to ESOC contains allmacro commands to allow commanding ofthe satellite. It also contains all of the house-keeping parameters, their defined monitoringlimits and the specific calibration curves thatare required to monitor the satellite duringthe mission.

– The Satellite Characterisation Database wasa deliverable from the satellite Mission PrimeContractor. It documents precisely, in a pre-agreed format, the results of all performancetesting executed throughout the satellitedevelopment and validation phase. Thecontents of the database, such as alignmentdata or CCD spectral calibrations, have beenused to build ground software for thegeneration of so-called ‘Level-1b products’from each instrument.

Ground Support EquipmentThe size and complexity of the spacecraft resultin demanding requirements on ground-supportequipment. Mechanical Ground SupportEquipment (MGSE) includes conventional itemssuch as a satellite trolley, vertical integrationstands for the Payload and Service Modules,lifting beams for spacecraft and panels, andturnover trolleys. The satellite trolleys, of whichthere are two, to support two satellite modelssimultaneously, each weigh about thirty tonnes.They must be disassembled for transport andto move from one clean room to another. Even

when disassembled, they are out-of-gaugeitems. Despite this, they are supported formovement on compressed-air pads hovering afew millimetres off the floor. This system worksextremely well and the trolley is routinelymanoeuvred by just two or three people.

The Electrical Ground Support Equipment(EGSE) is also large and complex, coveringabout 400 m2 of floor area and consuming 0.1 MW. There are three principal elements:– Service Module EGSE, including processors

to stimulate AOCS sensors and specialcheckout equipment for Service Modulesystems

– Payload Module EGSE, including specialcheckout equipment for payload subsystems

– Instrument EGSE organised around a singleIntegrated Test Assembly, but with a numberof dedicated data and processing blocks foreach of the instruments.

Each of these elements was based on standardsystems using the Elisa checkout languageprocured from Astrium SAS (formerly Matra,Toulouse). Unfortunately, evolution of thestandard between the procurement initiation foreach of the elements meant that neither thesoftware, nor the databases nor the hardwarewere interchangeable.

A significant and late addition to the EGSE wasa pair of the Front-End Processors designed forthe ground segment to ingest measurementdata. These provide possibilities to realisticallyprocess every virtual channel data unit andevery source packet, even at the highest datarate (100 Mbps). As a result, confidence in dataintegrity from every test is very high.

The EGSE used to test instruments was builtaround a standardised element, procured bythe Mission Prime Contractor, which preciselysimulated Polar Platform interfaces. TheIntegrated Test Assembly employed at satellitelevel used the same processor and software.This had two important benefits: time spentdebugging the instrument EGSE wasminimised by sharing resources, and theinstrument-level test software could be useddirectly at satellite level.

A consequence of the number of processorsinvolved in the EGSE has been lost test timedue to hardware defects, design deficienciesand software bugs. The duration of theengineering-model campaign was significantlyaffected by resolution of these issues. It seemsthat when procuring EGSE, paying much moreattention to system integrity and maintainabilitywould have saved significant cost in the overallprogramme.

DUBOCK 25-06-2001 09:05 Page 9

Figure 6. The PayloadModule box structure

around the central tube


34

Envisat’s size made it impractical to design acontainer to fit the integrated satellite into theAN124, which is largest commercially availablecargo aircraft. Consequently, the ServiceModule, Payload Module, ASAR antenna andsolar array will be transported separately andthe satellite reassembled in Kourou.

After assembly of the solar array, a test will beconducted to check that initiation ofdeployment functions correctly. A full electricaltest of the spacecraft will take place, followedby fuelling with 300 kg of hydrazine. All of theseactivities will happen without leaving the class-100 000 facilities within the S5 building. Thespacecraft will then be loaded into a specialtransport container for the short trip to the FinalAssembly Building (BAF), where it will be liftedonto the top of the launcher and encapsulatedin the fairing. Prior to encapsulation, the last ofthe remove-before-flight and install-before-flight items will be dealt with. There are morethan 300 of these in total, so this operation willtake place overnight. The assembled rocketwith solid boosters attached and satellitemounted will then be transported to the launchpad, along a parallel pair of railway tracks, onthe enormous launch table. Hopefully, thelaunch will take place at the very first launchopportunity, of which there is one per day.

Design and testingMechanical Mechanically, the satellite consists of the coneof the Service Module, which at its lower endinterfaces with the launcher and the centralcylinder of the Payload Module. Shear panelsattach sidewalls to form a stiff rectangular boxstructure. Figures 6 and 7 show the overallstructure.

Launch campaignEnvisat will be the first user of the new S5Payload Processing Facility in Kourou (Fr.Guiana). The launch team will occupy all of theavailable office space, all of the checkout areas,all of the integration room, and the smaller ofthe two fuelling halls.

About 340 tonnes of material will betransported to the launch site using adedicated Antonov AN124 aircraft for the flighthardware, two Boeing 747s for the EGSE, anda ship for the MGSE items. At the peak, therewill be about 120 project personnel supportingthe launch campaign, which will last aboutthree months. The MGSE will be set up by anadvance party about a month before the startof the launch campaign itself.

Figure 7. The ServiceModule’s mechanical

configuration

+ZST WallsSpacecraft Axes

Central Cone

LowerFloor

BatteryPlate

Solar Array Side+ZST Shear Walls

PropulsionSubsystemStructure

UpperPlatform

–YST Walls

Central ShearWall +ZST

–YSTExtension Wall

EMC Shear Wall

±YST Walls

±ZST Extension WallsReaction-Wheel Walls

–ZST Shear Wall

–ZST Walls

+YS

+ZS+XS

±YST Extension Wall

±YST Shear Walls

DUBOCK 25-06-2001 09:06 Page 10

Figure 8. Envisat beinginstalled on the HYDRAhydraulic shaker at ESTEC


35

The SM is built around a CFRP cone as theprimary structure, with a launcher interface atone end and the propulsion module at theother. Both interfaces are made of aluminium. Abox-shaped metallic structure, with aluminiumhoneycomb panels, supports the electronicequipment and surrounds the central cone.

The structure of the Payload Module consistsof a 1.2 m-diameter CFRP tube and a set ofCFRP sandwich panels forming the webs andexternal faces of the PLM box. The structure isconceived as a stack of four bays, each 1.6 mhigh. The bay furthest from the SM (bay 4) is designed to be removable from the otherthree.

Static load tests were conducted usinghydraulic jacks on separated structural modelsof the Service Module and the Payload Carrier.These tests involved loading the structure tothe equivalent of 2.8g at its centre of gravity.

The structural-model satellite programmebegan with a modal-survey test that allowedthe identification of modes, and their correlationwith the satellite finite-element model.Following the test, the interface to the solararray was stiffened.

Sine vibration (Fig. 8) of this very largespacecraft brought a number of problems. Thestructural model was the first object to betested on the new hydraulic shaker, HYDRA, atESTEC. HYDRA allows simultaneous excitationof the test object with three translations andthree rotations, although for Envisat only oneaxis was excited at a time. Even so, the satellitecan be tested without a physicalreconfiguration between axes, saving manydays on the critical path. It also allows acomplete set of very-low-level runs to beperformed at the start of the test campaign, toidentify early any unexpected behaviour of thenew test object and to confirm the safety of thetest. At the time of the structural-model test,the shaker’s development was not complete,and so only the longitudinal axis wasattempted, to avoid controllability problems inlateral. Even so, it was considered unsafe totest between 58 and 81 Hz. And qualification inthis domain was achieved by a sine responseanalysis using the finite-element model qualifiedby the modal-survey test. Lateral axes on thestructural model were tested on the electro-dynamic twin shaker also at ESTEC. The inertiaof the test object meant, however, that insteadof starting the sine scan at 5 Hz, it was startedat 15 Hz. Qualification below 15 Hz wasachieved using the results of the static loadtests. Despite these difficulties, the structural-model test results were useful in refining the

qualification and acceptance levels for bothequipment and instruments

For the flight-model acceptance test, theHYDRA had been much improved. Even sothere were serious concerns about itscontrollability. There were also concerns aboutthe effect of cross-talk from one axis to anotheron the validity of the test. An extensive series ofpre-tests were performed using a dynamicallyrepresentative dummy of Envisat. Theseshowed quite serious cross-talk between axesand excitation of spurious frequencies. Astrategy was adopted whereby cross-talkwould be accepted, and deep notches to thebase excitation predicted for launch accepted,provided all critical points were exercisedabove their flight limit loads at least once. In theevent, the damping and linear behaviourpresent on the flight model (but not on the

DUBOCK 25-06-2001 09:06 Page 11

Figure 9. The sine-vibrationspectra


36

from the launcher. In the event, the launcherauthority designed a shock-attenuation devicefor Envisat and a number of other missions.Also, a piece of pyrotechnic test hardware wasspecifically designed to produce the specifiedshocks at the spacecraft interface, rising from60g at 300 Hz to 2000g at 2500 Hz. Shockspropagating to the lower levels weresignificantly above design levels for a number ofequipment items, but the test was survivedwithout the slightest damage to any spacecrafthardware, and without any change in the statusof the relays.

A second issue of concern during thedevelopment programme was micro-vibration,

dummy) allowed the predicted baseexcitation to be achieved in all threeaxes with only one very minordeviation. A bonus was that the entireflight-model sine-vibration test wascompleted in just 7 days, compared tothe three weeks or more predicted forthe multi-shaker (Fig. 9).

To ameliorate the difficulties expectedin identifying the mode shapes of thefinite-element model in the results fromHYDRA, a novel ‘mini-modal-survey’test was performed. This test placed asingle exciter at one of the lifting pointsof the satellite, and was executed inless than a day. The results provided agood identification of modes in thefrequency range below 50 Hz. Therequired first lateral frequency for thesatellite is above 5.5 Hz. Themeasured first frequency is about 7.8Hz.

The design requirement from Ariane-5is for a longitudinal quasi-static load of4.55g and survival of 1g from 5 to 100Hz. Lateral accelerations are below0.8g up to 100 Hz. In common withmost large space structures, extensivenotching was necessary to protectsensitive items, such as the solararray, the ASAR antenna, and severalof the optical instruments.

The vibration spectra (Fig. 9), whichwere accepted by Arianespace on thebasis of coupled dynamic analysis,were less than 0.3g in longitudinal andless than 0.35g in one lateral axis from35 to 100 Hz. The other lateral axis (inthe plane of the Earth-pointing face)was less than 0.6g in the same region.

Acoustic tests on both the structuraland the flight models (Fig. 10) of thesatellite were conducted in the Large EuropeanAcoustic Facility (LEAF) at ESTEC. Thestructural-model test had allowed thederivation of random qualification levels forequipment and instruments. The acousticspectrum required by Arianespace has anoverall level of 142 dB. The level for the Envisatacceptance test was 138 dB. These reductionswere possible following flight experience with anumber of Ariane flights, and changes to thelaunch pad and fairing.

One issue that caused some difficulty duringthe development programme was shockspropagating into the spacecraft from theseparations of the fairing and of the spacecraft

DUBOCK 25-06-2001 09:06 Page 12

Figure 10. Envisat beinginstalled in the LEAFacoustic facility at ESTEC,with the solar array in theforeground


37

with a number of the optical instruments beingsensitive to small imported vibrations during themission. Analysis and some measurementsshowed that most noise was produced by theAOCS reaction wheels, and by the Stirling-cycle coolers in two of the instruments.Subsequent analysis has shown that the worst-case micro-vibration at the instrumentinterfaces would cause about a 0.1-microndisplacement and a 0.2 microrad rotation.These levels are acceptable by all instruments.

ThermalThe satellite is designed to fly along thedirection of the ASAR antenna, with the solar-array end of the spacecraft pointing towardsthe Sun, which appears to rotate around thespacecraft once per orbit. One orbit takesabout 100 min, with about 30 min in eclipse.The other end of the spacecraft points towardsdeep space and is used to accommodate theinfrared instruments, which require a coldenvironment for their detectors.

Reuse of Spot and ERS heritage technologydictated a flight direction at right angles to thelonger dimension of the spacecraft. Thisimplied that instruments on the cold tip (whichpoints towards deep space) had to bespecifically designed to fit into the limitedsurface area. It also implied that the ASARantenna had to be designed to fold up forlaunch.

The spacecraft’s thermal design is driven by theorbital conditions, and by the need to survive inthe Sun-pointing safe mode. The thermaldesign of the box structure of the basicspacecraft is classically passive. Portions of thebox’s surface serve as radiators, whilst the restis clad in multi-layer insulation. Externallymounted items, especially the instruments, aredesigned to have as little thermal interchangeas possible with the box structure itself.Systems of heaters operated by thermostatsprotect equipment in safe mode. Specificthermostat-controlled heaters protect thehydrazine system and the batteries. Software-controlled heaters are operating at other timeswhen on-board computers are available tocontrol them. The Instrument Control Unit ofeach instrument controls the thermalmanagement of that instrument when it is on. Anumber of optical instruments incorporate heatpipes to transfer heat away from detectors toappropriately positioned radiator plates.

In view of its size, it was impossible to performa thermal test on the spacecraft as a whole.The flight models of the Service Module andPayload Module were tested separately. Evenso, the Payload Module could not be loaded

directly into the ESTEC Large Space Simulator,but was separated between levels three andfour and the pieces re-mated inside thechamber (Fig 11).

The thermal-balance test on the ServiceModule was of the classical type, using solarsimulation and liquid-nitrogen-cooled shrouds.Performed during December 1996, it validatedthe performance of the thermal hardware andled to satisfactory correlation of the thermalmathematical models. It also revealed that theRCS heater power was insufficient. Thenecessary hardware modifications, such as thewiring up of available trim heaters and newadditional heater circuits, were thereforeincorporated after the test.

DUBOCK 25-06-2001 09:07 Page 13

Figure 11. Upper level of the Envisat payload being loaded into the Large SpaceSimulator (LSS) facility at ESTEC, for mating with the three lower levels


38

The Payload Module thermal-balance test wasperformed during August 1999. The physicalsize of Envisat (Fig. 12) also made it impossibleto illuminate it adequately with a simulated Sun.Consequently Sun, Earth and albedo inputswere modelled by the use of elevated shroudtemperatures and test heaters. The size of thePayload Module made it necessary to utilise thefull facility data-handling capacity of more than800 thermocouple channels.

Thermal testing of the flight payload showed apoor design of the vent holes for the internalcompartments. Inappropriate siting of iongauges also hindered measurements ofvacuum. As a consequence, high-voltageequipment could only be switched on safelylate during the test, such that the thermal-balance test phases had to be executedwithout X-and Ka-band operation. Additionaltest phases characterising the thermalperformance of these two subsystems had tobe added. After the test, the vent holes wereenlarged and a short handbook prepared onthe use of ion gauges.

The test verified the performance of the thermalhardware and allowed correlation of the variousmathematical models of the Payload Moduleand instruments. However, it also revealed thatthe heater power for the RCS thrusters wasinsufficient for flight and corrective measureshave been implemented.

Electrical The power subsystem uses eight nickel-cadmium batteries, each of 40 Ah, and a solararray delivering more than 6.75 kW at end-of-life. Power is provided to the satellite viaunregulated (22 – 37 V) and regulated (50 V)buses. The main power supply to the PayloadModule is via four permanent high-powerunregulated buses routed directly from theService Module power source point. Thepower-bus voltage follows the batterycharge/discharge characteristic. A junction andshunt regulation unit (RSJ) acts as the maininterface between the solar array and batteries,taking into account varying power demands. Apower distribution unit (BD) provides thenecessary switching and protection of powerbuses supplied to the Service Module.

Within the Payload Module, power isdistributed via two Payload Power DistributionUnits (PPDUs), which are controlled andmonitored by the Payload Module Computer.Each unit provides power switching andprotection of power feeds. One of thedistribution units is dedicated to theinstruments, the other to Payload Moduleequipment. Both distribution units are locatedFigure 12. The complete Envisat payload in the LSS at ESTEC

DUBOCK 25-06-2001 09:08 Page 14

Figure 13. Flight model ofEnvisat being prepared forRF compatibility testing,with the ASAR antenna atthe bottom of the picture


39

as close as possible to the SM/PLM interface inorder to minimise power-harness voltagedrops. During testing on the flight-modelsatellite, a design fault was discovered in aPPDU that allowed the unit to be switched offin a configuration in which it could not beswitched on again. A design modification wasintroduced to cure this.

The size and complexity of Envisat has resultedin more than 700 kg of harness being used on-board. It seems that electrical designapproaches such as are being applied on largeaircraft might become appropriate for this classof spacecraft.

Electromagnetic and radio-frequencycompatibility EMC/RFC aspects of the spacecraft aredominated by the radiated field from the on-board radars, and from the Ka-band trans-missions to Artemis. Test requirements include:– 62 V rms from 2.0 to 2.5 GHz S-band – 80 V rms from 3.0 to 3.4 GHz RA-2 S-band– 160 V rms from 5.15 to 5.5 GHz ASAR– 80 V rms from 13.2 to 13.9 GHz RA-2 Ku-band.

While testing transmit/receive modules for use

in the ASAR antenna, it was discovered that the receivers were susceptible to RA-2transmissions. Filters were fitted to the transmitmodules for 12 tiles to avoid this. In all othercases, tests conducted at equipment leveldemonstrated compliance with these levels.

RF compatibility tests on the engineering- andflight-model satellites (Fig. 13) with deployedantennas demonstrated compatibility of theentire operating satellite with the transmittedpower levels. These two tests each involved theconstruction of a large RFC facility covered withRF-absorbent cones within the clean room.The supporting structure was built by Brilliant

Stages, a company better known for its workon outdoor rock concerts, but it was able towork quickly and effectively in parallel withnormal testing. In the case of the engineering-model spacecraft, the facility entirelysurrounded the spacecraft. The facility for theflight model was simplified so that only a cornerand a roof were constructed to avoid reflectionsof the Earth-facing antenna beams. The twoantennas on the rear side were not radiatingduring this test, having been validated on theengineering-model satellite.

DUBOCK 25-06-2001 09:08 Page 15

Figure 14. Block diagram ofEnvisat’s On-board Data-Handling (OBDH) System

These radiated-field requirements weresupplemented by the usual requirements forcompatibility with the launcher. One latedemand from the launcher authority originatedfrom a new military radar protecting the launchsite itself, but it has also been possible to showthat it will not affect Envisat.

Low-frequency conducted interference isdominated by power-bus ripple originating fromthe on-board Stirling-Cycle coolers, and fromthe pulsed power demand of the ASAR. Testsat the equipment, Service Module and satellitelevels have demonstrated self-compatibility ofthe satellite in the presence of these signalswith a margin of 6 dB.

The satellite has been successfully designedand tested for avoidance of, and immunity toelectrostatic discharges. All conductiveelements of the structure, including the solararray, CFRP and aluminium panels, thermalblankets and thermal finishes, are electricallybonded together to form an effectiveequipotential conductive surface, therebyavoiding differential electrostatic charge build-up. All panel surfaces and cable harnesseshave also been designed to form a Faradaycage providing electromagnetic shielding.

Measurement data handlingThis function is responsible for the acquisition,formatting, recording, and communication tothe Payload Data Ground Segment of

measurement data generated by the Envisatpayload (Fig. 14). The High-Speed Multiplexer(HSM) collects CCSDS Instrument SourcePackets (ISPs) generated by the payloadinstruments (at bit rates up to 22 Mbps in thecase of MERIS). It formats and encodes theseISP data into Virtual Channel Data Units thatare multiplexed together to produce two typesof data frames generating Channel AccessData Units (CADUs). One frame is for recordingby one of the two solid-state recorders or bythe tape recorder, the other is for real-timegeneration to the Payload Data GroundSegment.

CADU data streams (either from the dumpingof a recorder, or generated by the HSM in realtime), are collected by the Encoding andSwitching Unit (ESU), which routes each of thedifferent CADU data streams to either the X-band or the Ka-band communicationsubsystem. The ESU also collects the two 50Mbps data streams from the ASAR payloadinstrument (this high data rate results from theoperation of ASAR in Image mode), and routesthem either directly to the communicationsystems or to one of the two solid-staterecorders for later dumping.

The Kiruna X-band ground station providesonly about 10 minutes of satellite visibility perorbit. The add-on capability of data relay viaArtemis provides an additional 20 minutes ofvisibility per orbit. Payload data must be


40

DUBOCK 25-06-2001 09:09 Page 16

Figure 15. The Ka-bandantenna undergoingdeployment testing

The satellite command and control systemThis system is organised around two On-BoardData Handling (OBDH) systems (Fig. 16), amaster Service Module data-handling system,and a Payload Module data-handling systemslaved to the SM OBDH bus. Each module hasa dedicated computer to which equipmentitems are connected through OBDH digitalserial data busses.

Service Module command and controlThe SM data-handling subsystem performs theprocessing and sorage of housekeeping data,the management of telecommand andhousekeeping telemetry (at the interface withthe S-band ground stations), the data-buscontrol, the satellite alarms management, andthe clock generation to all OBDH peripherals,including the Payload Module.

delivered not later than 3 h after datageneration. To meet these constraints, thePayload Module carries two Solid-StateRecorders (SSRs), each providing adynamic RAM capacity of 70 Gbit. Thesetwo SSRs allow independent recording (4.6Mbps) and dumping (50 Mbps) of theEnvisat low-bit-rate composite, of the ASARhigh-bit-rate data (100 Mbps record anddump), and of the MERIS full-resolution data(22 Mbps record and 50 Mbps dump).Initially, the Payload Module embarked fourtape recorders. These units proved to be soquestionable that the Agency and its PrimeContractor decided to procure two SSRs. Asingle tape-recorder unit has, however, beenretained on-board as a additional sparecapability to record and to dump the low-bit-rate composite.

Envisat is equipped with two distinctcommunication subsystems accommodatedwithin the Payload Equipment Bay (Table 6).The X-band communication subsystem hasthree communication channels operableindependently and, if need be, simultaneously.Each channel is equipped with a QuadraturePhase-Shift Keying (QPSK) modulator and aTravelling-Wave-Tube Amplifier (TWTA) and,after band-pass filtering, the modulated signalsare added through a wave-guide outputmultiplexer. The resulting composite spectrumis radiated to the Payload DataGround Segment via a shaped-reflector antenna. The three frequencycarriers used by this subsystem are8.1, 8.2, and 8.3 GHz.

The Ka-band assembly (Fig. 15) isalso composed of a three-channelcommunication subsystem. Theassembly uses a 2 m deployable mastlocated on the opposite side of the satellite to the Earth. The mast is equipped with an azimuth andelevation pointing mechanism, whichsteers a 90 cm-diameter Cassegrainantenna pointed to the Artemissatellite. Pointing commands aregenerated by an Antenna PointingController, which is accommo-dated together with the RF part of the assembly within the Payload Equipment Bay. Thesubsystem carrier frequencies are26.85, 27.10 and 27.35 GHz. Thesystem operates in open loop, whichmeans that the Artemis Ka-bandtransponder will track Envisat using itstelemetry, without the need for anextra tracking beacon or trackingreceiver.


41

Table 6. Link budgets

Ground Station Antenna: 32 dB/K G/T X-band

100 Mbps (QPSK) 3.6 dB50 Mbps (BPSK) 5.7 dB

Ground Station Antenna: 37.2 dB/K G/T Ka-band

100 Mbps (QPSK) 1.64 dB50 Mbps (BPSK) 4.64 dB

DUBOCK 25-06-2001 09:09 Page 17

Figure 16. The Envisatsatellite command and

control concept

It is based on a Central Communication Unit(CCU), which handles the exchange ofinformation between the ground and the SMequipment via the OBDH data bus. It containsan ultrastable oscillator, from which all satellitetiming is generated. The CCU communicatesthrough the SM OBDH bus with the PayloadManagement Computer located within thePLM. The CCU also serves as the maincomputer for the Attitude and Orbit ControlSubsystem (AOCS). Dedicated controlalgorithms and monitoring functions areimplemented into the CCU software.

The Decoding and Reconfiguration Equipmentis responsible for receipt of the telecommandsgenerated by the ground segment, and theirdecoding. This unit also acts as a watchdogwith respect to the CCU and can commandsatellite switch-over to a safe mode in the caseof a major CCU anomaly. In such a case,command and control of the satellite’s mainsurvival functions relies on software containedin a PROM

The S-band communication assembly providesa bi-directional telemetry and telecommand linkwith the ground and is used for overall satellitecommanding, monitoring and control. It providesa 2000 bps forward and 4096 bps return S-band link to ground, via two S-band antennasoperating with cardioid radiation patterns and opposite circular polarisations. Omni-directionality of the link allows communicationin any non-nominal attitude. The antennas areconnected via a passive hybrid to two S-bandtransponder systems. Unlike the Spot and ERS transponders, an internal real-timeprocessor pilots the transponder on Envisat.The mission-critical software in this processor

was subjected to independent softwarevalidation prior to its acceptance. The S-bandtransponder modulates housekeeping telemetry,demodulates telecommands, and supportsranging and range rating by the terrestrialcommand and control ground stations.

The SM housekeeping system comprises two units. The housekeeping and pyrotechnic unit (BSP) monitors temperatures and issues thermal-heater and pyrotechnic-firingcommands. The Electrical Integration Unit (EIU)arms and powers the thermal knives andmotors used to release and to deploy the solararray, monitors its deployment, and enablesretraction if required.

The problems experienced during thedevelopment and validation of the SMcommand and control system have beenlimited because of the experience acquired withthis bus for previous missions such as Spot-4and Helios-1. One exception has been theinheritance of the dual-mode transponderdesign from Columbus serviceable missions.Because of its mission-criticality for Envisat,this subsystem had to be carefully analysed. Itssoftware was simplified and modified toincrease its reliability. To avoid permanent uplinkloss due to simultaneous latch-up of bothDMTs, the CCU will automatically reset theDMTs if it has not received a valid telecommandwithin the last 24 h.

Payload Module command and controlThe Payload Module avionics is decoupledfrom the Service Module. Its provides its ownpower distribution, operates its own OBDHbus, and is controlled by a specific PayloadModule Computer (PMC), which performs


42

DUBOCK 25-06-2001 09:09 Page 18

Satellite Attitude and Orbit Control SystemThe AOCS provides three-axis stabilisation ofthe satellite body, which remains fixed in thelocal orbital reference frame. It ensuresacceptable pointing and pointing-stabilityperformance for the payload instruments andsensors (Table 7).

In nominal operational modes, the CCUsoftware processes all AOCS signals receivedfrom the sensors and controls the AOCSmodes. Figure 17 shows the satellite AOCSmode transition diagram. The sensors are: – A set of four independent two-axis gyro-

scopes: two are used for nominal operations,with the other two remaining in cold backup.

– Two Digital Earth Sensors (DES): one is usedfor nominal operations, while the other is keptin cold redundancy.

– Two Digital Sun Sensors (DSS): one is usedfor nominal operations, while the other iskept in cold redundancy. DSS is not used forattitude control in SYSM.

– Three Stellar Star Trackers (SST): any pairused for SYSM, with the third kept in coldredundancy.

In nominal operations, the CCU softwarecomputes the attitude and pointing estimationusing correction algorithms that are AOCS-mode dependent. It also generates commandsto the following AOCS actuators:– 16 thrusters, 8 allocated to each nominal and

redundant actuator chains. They are used forinitial attitude control, in- and out-of-planemanoeuvres, and safe mode. The backupthrusters are kept in cold redundancy.

– 5 reaction wheels, each with a 40 Nm/scapacity (two wheels on Y- and Z-axis, onewheel on X-axis)

tasks including scheduling of the commandedmission, monitoring of the Payload Modulesystems (Payload Equipment Bay avionics, andpayload instruments).

The PMC operates as the payload-instrumentmaster controller. It communicates with the SMvia the SM OBDH bus, and commands andcontrols all the Payload Module equipment andinstruments via a separate Payload ModuleOBDH bus. It also routes housekeeping telemetryback to the PMC for transmission to the SM.

The PMC manages two types of macro-commands; immediate macro-commands, forexample an immediate request of a specialhousekeeping telemetry format during visibilityover a ground station, or time-tagged commandsdestined for PEB subsystems or payloadinstruments. Mission-planning commandsaimed at performing autonomous round-theclock operations without ground intervention arestored as a queue of time-tagged commands.

The PMC gathers and formats PLM subsystemand payload-instrument housekeepingtelemetry, which will be merged by the SM CCUwith SM housekeeping telemetry prior todownlinking. The PMC transmits to the PEBsubsystems and to the payload instrumentICUs, time-synchronisation signals derivedfrom the pulses generated by the SM. Thistime-synchronisation function allows correlationof the onboard time-of-occurrence of specificevents with the UTC time used on the ground.

The PMC also packetises the overall satellitehousekeeping telemetry generated by the SMinto a stream of ancillary source packets. Theseancillary data contain in particular thespacecraft’s orbital position parameters withrespect to the satellite onboard time. They areused by some instruments to schedule specificactivities (e.g. Sun or Moon occultationactivities for SCIAMACHY). These ancillary dataare also routed to the High-Speed Multiplexer,which allows the ground segment to receivethe satellite housekeeping telemetry generatedduring non-visibility periods.

Instrument Control Units (ICUs) are responsiblefor the instrument command and controlfunctions, ranging from the management oftelemetry/telecommand flows between thePLM OBDH and the payload instrument units (MWR, DORIS), to the management ofinstrument internal data buses and ofcommunication with secondary scientificprocessors connected to them (MERIS, RA-2,ASAR). Each payload instrument is equippedwith an ICU, as is the Ka-band AntennaPointing Controller.


43

Table 7. Pointing stability performance for the most demanding payload instruments

Time Period Budget for Worst Axis Requirement for All Axes(sec) (deg) (deg)

1.6 0.0017 0.0040(SCIAMACHY)

4.0 0.0036 0.0040(MIPAS)

75.0 0.0135 0.0150(MIPAS)

110.0 0.0138 0.0200(SCIAMACHY)

120.0 0.0143 0.0300(AATSR)

170.0 0.0139 0.0300(MERIS)

DUBOCK 25-06-2001 09:09 Page 19

Figure 17. Mode transitiondiagram for nominal AOCS

modes

– 4 magneto-torquers, forming two pairs. Theyare actuated at the correct satellite orbitalphase (depending on their alignment wrt theEarth’s gravity field) to control the maximumspin rate of the reaction wheels on the relevantaxis.

– 4 tanks containing 300 kg of hydrazine forinitial orbit acquisition and orbit-maintenanceactivities.

– A solar array drive mechanism (MEGS) tocontrol the solar array’s rotation (1 rotationper orbit). At a second level, the MEGS isalso controlled to compensate for the solararray perturbations due to flexible modes,which are detected by the gyroscopes.

Table 8 provides an overview of the sensorsand actuators used for each AOCS mode.


44

Table 8. Satellite AOCS modes and associated main characteristics

Mode of Operation Comments Sensors and Actuators

Operational Mode YSM or SYSM Operational mode with fine satellite Reaction wheels with magnetic torquerspointing YSM: 1 Digital Earth Sensor,

Geocentric pointing, 1 Digital Sun sensor and 2 gyroscorrection for the local normal SYSM: 2 SSTs and 2 gyros pointing, and yaw steering bias

Orbit Control Mode OCM Out-of-plane orbit maintenance 1 Digital Earth sensormanoeuvres. 2 gyros∆V > 0.05 m/s along Y-axis after 8 thrusters90 deg rotation around Z -axis.Payload mission interrupted.

FCM or SFCM In-plane orbit-maintenance manœuvres 8 thrusters Mission not interrupted FCM: 1 Digital Earth sensor,

1 Digital Sun sensor and 2 gyrosSFCM: 2 SSTs and 2 gyros

Satellite Safe Mode SFM +Z Sun pointing 0.4 deg/s T4S PROM software-controlled< Satellite rate < 0.65deg/s 8 thrusters TM/TC and AOCS control 2 SAS (+Z and –Z)through T4S PROM software. 2 gyros

Attitude Re-acquisition RRM->CAM>FAM Earth re-acquisition by 8 thrusters(exit from safe mode) Earth sensors 1 digital Earth sensor

Payload Module put into safe mode 1 digital Sun Sensor2 gyros

DUBOCK 25-06-2001 09:09 Page 20

Attitude control using thrusters results in coarsepointing performance. The other satellitemodes are used for orbit maintenance oroperational transition towards fine-pointingmodes. These modes use monopropellantthrusters for attitude control. In these coarsepointing modes, attitude measurement isprovided by a Digital Sun Sensor, a Digital EarthSensor, and two two-axis gyroscopes.

Orbit manoeuvres are required to achieve thecorrect orbit following separation and to correctthe spacecraft altitude (compensation of theair-drag effect) and inclination over themission’s lifetime. Inclination manoeuvresrequire delta-V firings normal to the orbitalplane, which is achieved by rotating thespacecraft by 90 deg, before and after thefiring. For protection against mis-pointing,vulnerable instruments are switched to eitherstandby or heater mode during the manoeuvre.Large in-plane manoeuvres (via Orbit ControlMode, OCM) for initial orbit acquisition orrepeat-cycle changes are also undertaken byusing an OCM sub-mode. Small firings in theplane of the orbit, through the FCM, are used tocompensate for air-drag effects. During theseFCM manoeuvres, the satellite maintains itsnominal attitude and the overall mission isunaffected, although pointing degradationoccurs (Table 9).

AcknowledgementSome of the engineering challenges involved inthe long development of Envisat have beendescribed in this article. The development efforthas involved literally thousands of people. Theyshould consider themselves thanked here.Obviously they are far too numerous to name.For the authors, it has been an immenselyrewarding experience and we look forward to asuccessful mission. r

If major anomalies prevent the CCU fromperforming its nominal tasks (control of themodes above), a specialised Service ModulePROM-driven processor (the T4S) can takeover AOCS control and keep the satellite in ahealthy power and thermal configuration, in so-called ‘Satellite Safe Mode’ (SFM). The SFMuses attitude information from two specialisedSun-acquisition sensors and rate informationfrom two two-axis gyros. In SFM, the satellite’sattitude is controlled by thrusters, the nominalsatellite zenith axis is pointed towards the Sun,and a slow angular rate (0.4 – 0.6 deg) ismaintained around Z to keep all of the satelliteequipment in a safe thermal equilibrium.

The prime satellite AOCS operational mode isstellar yaw-steering, deriving the satelliteattitude from the SSTs and the satellite ratesfrom the gyroscopes. Commands are sent tothe SST sensors using a ground-based starcatalogue tuned to the spectral characteristicsof the SST optics. The time of detection of thecommanded star, and its position within theSST field of view allow the onboard software toderive an attitude measurement for the satellite.The SYSM software uses SST attitude-measurement data from two of the three SSTs(all accommodated on the Payload Module)along with rate data from two-axis gyroscopes.Within the CCU, these data are combined toderive an estimate of the satellite pointing withrespect to the orbital reference frame (close tothe most pointing-demanding limb-sounderinstruments such as MIPAS), along with thenecessary pointing corrections to be appliedthrough commands to the reaction wheels. Thegenerated commands create control torquesusing the five reaction wheels accommodatedalong the three satellite axes to keep thesatellite pointing as close as possible to therequired orbital reference frame, therebyensuring the required satellite pointing. Inaddition to attitude-control torques, themagneto-torquers are activated in phase withthe satellite position on the orbit to maintain thereaction wheels within operational limits.

In addition to SYSM, there are two other modes(FPM and YSM) that use wheels for fine attitudecontrol. Both of these modes use gyroscopes,Earth sensors and Sun sensors for attitudedetermination. In the event of complete SSTfailure, the YSM mode can form a backupoperational mode (used nominally on ERS-1and -2) with degraded pointing and rateperformances arising from sensor errors andmeasurement frequency. Currently, these twomodes are only used as transition modes toenter SYSM.


45

Table 9. Performance of AOCS non-operational modes

AOCS Non-operational Axis Budget Requirements Mode (deg) (deg)

Fine Acquisition Mode all 4.90 5.0

Fine Control Mode X and Y 0.27 0.2Z 0.33 0.7

Orbit Control mode All for in-plane manoeuvres 1.10 2.0All for out-of-plane manoeuvres 1.70 2.0

Safe Mode Z in sunlight 10.50 8.0Z in eclipse 17.50 20.0

DUBOCK 25-06-2001 09:09 Page 21

the envisat satellite and its integration

Documents