Lessons Learnt from satellites onboard operations

1
Lessons Learnt from µ-satellites on-board
operations

• Jean-Christophe Lloret
• Julien Barba
• Daniel Barria
• Thierry Médina
• Eric Sawyer

Space Operations CNES TOULOUSE
2
Introduction

• 3 missions / 6 satellites sharing a
  micro-satellite platform (Myriade)
• Demeter analysis of ionosphere perturbation
  induced by geophysics' phenomena
• Essaim (4 satellites) Defense mission
• Parasol study of aerosol and clouds (part of
  the Aqua-Train)

I Definition and validation of Myriade flight
operations II Difficulties and challenges
specific to Myriade context
3
INTRODUCTION

• III Lessons Learnt in Orbit
• Operational impact of frequent anomalies
• 17 safe modes in 1,5 year but mission
  availability over requirements (gt 80)
• Technical and organizational responses
• Command/Control rules

4
Process for preparing flight operations
Operational tools
5
Flight Operation preparation activities

• (1) Operational team Training
• Concerns Satellite knowledge, languages, tools
• Objectives (1) flight operation preparation
  (2) autonomy after launch
• Means input documentation tutorials /
  interactions with sat. experts
• Operation Data Definition
• Operation documentation (Flight Control
  Procedures)
• System database ground computed and satellite
  ground monitoring
• Mimics
• Satellite Monthly report definition
• Operation data validation
• Testing using the satellite or a simulator
• Reviews

6
Flight Operation preparation activities

• Enabling tools development
• Tools supporting the process (editors,
  verificators)
• Tools operational used (monthly report..)
• Heavy and crucial activity in the Myriade context
• Technical coordination
• Flight operation preparation should be managed
• Validation highly participate to training
• Planning made such as team members could rotate
  on tests
• Quality assurance
• Data definition and management rules should be
  defined prior to qualification
• Management of common data
• Right compromise between PA requirements and what
  is acceptable by the team.

7
Flight preparation activities points to outline

• Operation preparation is an integrated process
• Strongly inter-dependant activities
• For instance, careful planning of training
  required
• The process is highly iterative
• Validation provides feedback for improving
  operational data
• New needs for enabling tools revealed (e.g. FCP
  automatic generation)
• Inputs from experts should be requested and
  discussed early
• Experts are involved at two levels
• Support for operation preparation (reference
  information, training, expertise)
• Customers of the operational system (requirements
  for mimics, ground monitoring, satellite monthly
  report)
• Direct interaction between the operation team and
  satellite experts promoted

8
Operational documentation

• Inputs
• Satellite operating manuals
• Onboard Software Specifications
• Equipment Interface Control Documents
• TM/TC satellite database
• Outputs
• Sequence plans high level procedures and
  operational chronologies
• Flight Control Plans unitary procedures
  automatically executed from the ground center
  onboard the satellite
• Process
• Time consuming activity to produce operational
  data
• performed by satellite operation engineers
  (end-users highly contributes to training).

9
Flight Control Plans definition and validation

• Process very similar to SW development
• FCP language is a programming language
• Enables to send TC and check TM
• Comments
• Control (IF THEN ELSE) loops (WHILE)
  instructions
• FCP are executed automatically by the ground
  control center
• Writing rules (documentation, presentation)
  required to ensure FCP quality
• Like code, many FCP can be generated
  automatically (500 out 800 for Myriade).
• Iterative process efficient tools (editor,
  documenters) required
• 100 testing coverage required
• Configuration and validation results management
  is a critical activity

10
Flight Control Plans definition and validation

• Process specificities
• Thematic knowledge required
• Good knowledge of the satellite
• Operational experience
• Operability guidelines required to constraint FCP
  definition
• Inter-dependance with other operational data
  (mimics, ground computed)
• System validation
• FCP validation requires the satellite or a
  simulation bench

11
FCP Definition Rules

• Naming rules
• An important matter (potential cause of operating
  errors)
• Fully qualified names chosen (e.g.
  STR-OFF_to_STANDBY.pln)
• Documentation rules
• Predefined header skeleton with descriptive and
  management attributes
• Operability rules
• Formalized verifications (of type CHECK
  TelemetyParameter Value)
• As FCP pre-conditions and post-conditions / after
  each sending of telecommand
• Secure and efficient (executed automatically)
• Atomic steps (Part of an FCP executed without
  operator take over)
• FCP designed as sequence of automatic steps for
  fast and secure execution
• Immediate execution preferred to Time Tagged
  execution
• For a better control of the operation (check TM
  not possible in TTG plans)

12
Flight Control Procedure documentation tags
STR-OFF_to_STANDBY
13
Flight Control Procedure modularity

• Objectives
• Reusability (FCP are functional modules,
  sequenced in global operations)
• Facilitate testing and configuration management
• A compromise based on the following criteria
• No redundancy code duplication should be
  avoided
• Adaptability to new operation chronologies
  (passes, functional sequencing)
• Pass constraint FCP duration should not exceed
  a pass
• Global operation plans
• Definition of high level plans corresponding to
  global operations and calling more elementary
  plans.
• For a better usability and understanding

14
Flight Control Procedure modularityExample of
Star Tracker plans
STEP-STR-switch_ON
STR-OFF_to_Standby(T1)
STEP-STR-download-parameters
STR-Configuration(T5)
STR-Standby_to_Attitude(T3)
15
FCP validation and configuration management

• Objective
• ensure that FCP are correct before their
  execution onboard
• A highly iterative process
• Up to 20 different versions for a DEMETER FCP
• A critical part of operation preparation and time
  consuming
• About 800 FCP in Myriade operational FCP library
• Requirements on FCP management process
• FCP should be configuration managed
• FCP validation status should be marked out (for
  each FCP version)
• Reports should be produced for reviews and
  pre/post test briefing
• Multi access (read/write) to the FCP repository
  should be managed

16
Architecture for validation management
17
Addressed difficulties (1) Multi-mission
management
Transversal activities 110 men per month
DEMETER Flight Operation Preparation 40 men per
month
DEMETER Ops 9 m.p.m.
ESSAIM Flight Operations Preparation 35 men per
month
PARASOL Flight Operations Preparation 30 men per
month
1rst April 03 DMT QTO
29th june 04 DMT launch
1rst jan. 04 PAR QTO
June. 03 ESS QTO
18th dec. 04 (launch PAR ESS)
18
Multi-mission management operational team
organization

• Transversal functions
• Technical coordination
• Team organization, schedule, technical
  management, IF with system project
• Satellite sub-system specialists (for each
  satellite sub-system)
• Develop an expertise on a particular satellite
  sub-system (AOCS, Alimentation)
• Define / validate operational data (FCP, mimics)
  related to a given sub-system
• Proved to be very efficient to ensure the
  commonality of data between missions
• Satellite database specialist
• implementation and validation of database items
  which are operation specific
• Mimic specialist
• Definition and management of mimics
• Monthly report specialist
• Implementation of satellite monthly report
  requirements

19
Multi-mission management operational team
organisation

• Transversal functions
• Tool developer
• Quality and data management support
• Simulation bench specialist
• Vertical functions
• A Satellite operation manager per mission
• Satellite operation specialists
• Specifically trained to ensure operations for a
  given mission (launch, commissioning).
• Operational team
• 14 persons at most
• Multi-function persons

20
Multi-mission management common data

• A driving requirement
• Define and manage common data once
• A simple solution used for FCP files
• FCP repository hosted on a server on intranet
• Access (read/write) for all satellite engineers
  from PC
• A root directory per mission, and FCP files
  organized in sub-directories
• Use of shortcuts not to duplicate common files
• Using a configuration management tool would be an
  improvement

21
Multi-mission management common FCP files
...
Parasol specific
22
Addressed difficulties(2) Strong delegation from
satellite / system project

• Delegated activities (usually perform by the
  system team)
• A global responsibility of operation engineering
• Specification of flight operations,
• Formalization of satellite experts requirements
  (satellite ground monitoring)
• Drawback
• More work !
• Advantages
• A more interesting work
• Stronger interactions with satellite experts
  (integrated team)
• An gain in expertise greater than in other
  projects
• Operational data defined in a more consistent way
  
• Operational constraints directly taken into
  account

23
Addressed difficulties(3) Missing tools

• Use of a generic control center
• Myriade specificities not always taken into
  account
• Some of the available tools too basic to prepare
  operations efficiently
• Types of tools being developed
• Operation preparation support (10 months)
  Integrated Development Environment (FCP editor,
  documenter, verification, automatic generation)
• Tools used during flight operations (2 months)
  specific telemetry analysis
• Satellite monthly report tool (9 months)
• Organization for development
• A software developer integrated in the satellite
  operation team
• Lessons for future
• The development of tools should be anticipated
  before qualification
• But some needs are always identified lately (e.g.
  FCP automatic generation)

24
Lessons learnt during operationsfrom numerous
satellite anomalies
2004
2005
02/01
19/12
27/7
01/09
DMT
Launch
PAR
PAR and DMT safe modes
DMT
LV2.51
LV2.53
LV2.4.3
PAR
LV2.2.3
LV2.2.4
PAR and DMT Platform Software uploading

• A much higher level of activity than foreseen
• Problems managed efficiently (mission
  availability gt 80 for DMT)
• Response both organizational and technical
• Lessons in terms of Command / Control rules

25
Satellite team organization for flight operations

• Organization for launch
• Interactions during passes, with satellite/system
  specialists formalized
• Two satellite engineers during critical phases
  (crossed verifications)
• Organization for routine
• Five engineers to operate six satellites / three
  missions
• Rotation on weekly basis performed over the
  different missions
• For a better sharing of tasks
• To ensure on duty shifts during nights and
  Week-ends.
• Project and satellite experts support
• Concerns expertise in case of anomalies,
  satellite monthly report analysis
• This support should be formalized

26
Satellite monitoring and procedure automation

• Satellite ground monitoring
• Adjustment of satellite monitoring is of great
  importance after launch (not to be polluted by
  false alarms which may hide important ones).
• Routine operation automaton
• Several entries to safe mode where caused by a
  STR dazzled by the moon
• Monthly attitude maneuvers are programmed to
  avoid the moon
• Generation of maneuver FCP has been automated.
• Recovery operation automation
• Flight Control Plans should be automatically
  triggered when
• Satellite safety is put at risk
• Non ambiguous anomaly signature to trigger
  automatically an FCP
• No potential risk to execute the triggered FCP
• Example FCP executed upon entry of the
  satellite into safe mode

27
Example of operability rule learnt with Myriade

• No telemetry management
• Rule FCP which can be executed without
  telemetry should be designed specifically and
  validated in representative conditions.
• Counter-example
• Telemetry lost in July 04, after sending a TC
  forcing the satellite into safe-mode.
• It was forgotten that TX is switched off upon
  transition to safe mode
• Testing did not reveal the problem.
• The simulator was not configured into real pass
  mode
• TM was always provided, even with a switched off
  TX

28
Conclusion

• Myriade operation preparation was a challenge
• Many members of the team with no experience of
  flight operations
• DMT was the first launch of the Myriade product
  line
• Parallelism between missions
• Lack of basic tools
• It proved to be a success
• A fully trained and competent team
• Operational documentation and data of quality
• Operations (in particular reaction to anomalies)
  conducted securely and efficiently.
• A rigorous methodology and adapted organization
  was a key
• But also team motivation and team spirit.