AOCS OPERATIONS PREPARATION FOR THE BEPICOLOMBO MISSION TO MERCURY

The 2018 ESA/JAXA BepiColombo mission to Mercury features a complex modular design, with two scienti¦c Mercury orbiters and a cruise module. The spacecraft (S/C) and mission design lead to a number of challenges for the attitude and orbit control system (AOCS), including electric propulsion usage during cruise to Mercury, AOCS capability to deal with several S/C con¦gurations, and strict attitude constraints owing to the harsh thermal environment. This paper presents the activities for AOCS operations preparation by ESA/ESOC, covering the current preparation status as well as an outlook on upcoming activities before launch.


Mission Overview
BepiColombo, an ESA cornerstone mission to Mercury in collaboration with the Japanese Space Agency (JAXA), will study the planet interior and surface and its environment, i. e., both exosphere and magnetosphere.The mission consists of ESA£s Mercury Planetary Orbiter (MPO) and JAXA£s Mercury Magnetospheric Orbiter (MMO), launched together as a single composite that includes a dedi- BepiColombo is planned to be launched in 2018 with Ariane-5 from Kourou.The launch will be followed by a 6.5-year cruise phase, including planetary swingbys at Venus and Mercury, eventually achieving a weak capture by Mercury in late 2024 (Fig. 1).During the cruise phase, electric propulsion will be used for extended periods of time.This is provided by the MTM module, which will be jettisoned at Mercury arrival.A set of complex manoeuvres will deliver the MMO to its operational orbit and, ¦nally, the MPO will be put into its 1500 × 480 km polar orbit (orbital period of 2.2 h) to perform its scienti¦c mission for one Earth year, with 1 year extension possible [1].During interplanetary cruise, the MMO is a passive passenger, i. e., the necessary resources and services are provided by the MPO until it is delivered into its mission orbit.The MTM provides solar electric propulsion (SEP) and all services not required in Mercury orbit.

The BepiColombo Spacecraft
The MPO accommodates 11 scienti¦c instruments and has a box-like shape with a size of 3.9 × 2.2 × 1.7 m and a dry mass of about 1080 kg.The harsh thermal environment around Mercury imposes strong requirements on the S/C design, requiring high-temperature multilayer insulation and solar array (SA) technology.A radiator to dump excess heat into space is mounted on one side of the S/C which may not be exposed to Sun or Mercury.
The MPO 3-axis stabilized AOCS consists of star trackers, inertial measurement units (IMUs), ¦ne Sun sensors, reaction wheels (RWs), and chemical propulsion.The AOCS design is driven by the challenging thermal environment around Mercury, requiring special guidance pro¦les for the MPO SA (to avoid overheating) and rapid S/C attitude stabilization in case of contingencies.In order to cope with these contingency cases, the onboard computer (OBC) contains a separate processing unit, namely, the Failure Control Electronics (FCE), for controlling the S/C attitude in case of transient unavailability of the main OBC.For deep space communications, the MPO uses a X/Ka-band deep space transponder with steerable high gain (HGA) and medium gain antennae (MGA).
In addition to dual mode bipropellant chemical propulsion, the MTM features a SEP system with 4 steerable thrusters based on the Kaufman-type electric bombardment ion motor (maximal thrust 145 mN).The high power demand by the MTM electric propulsion (up to 11 kW) is satis¦ed with large SAs (area of over 40 m 2 in total) using the same high-temperature technology as for the MPO.

The BepiColombo Mission Operations Centre at ESA/ESOC
Operations of the composite S/C and the MPO will be conducted from the European Space Operations Centre (ESOC) in Darmstadt, Germany.The main elements of the BepiColombo Mission Operations Centre (BCMOC) at ESOC are shown in Fig. 3.It features the typical setup for ESA/ESOC deep space missions, including a SCOS-2000 based mission control system, a standalone mission planning system, and a SIMSAT-based S/C simulator.The simulator, running the MPO §ight onboard software (OBSW) on a processor emulator, is a key tool for operations preparation [2].
The Flight Control Team (FCT) performs the operations of BepiColombo and interfaces with various multimission support groups at ESOC, such as §ight dynamics, ground segment software and hardware support (e. g., mission control system), and ground station operations.For deep space missions, there is a particularly close relation to the §ight dynamics team due to the complex navigation and AOCS operations activities.
Prior to launch, the FCT deals with all aspects of operations preparation.Key activities include the following: speci¦cation and acceptance testing of mission control system, planning system, and simulator; preparation of operational products: writing of the Flight Operations Plan (FOP) based on inputs provided by the prime S/C contractor as well as population of the S/C database; and execution of tests with the S/C §ight model as well as the engineering test bed (ETB), with the prime objective of validating the ESOC ground segment and operational products.
Due to the highly constrained mission and complex con¦guration of the composite S/C, BepiColombo operations are very challenging [3].

THE ATTITUDE AND ORBIT CONTROL SYSTEM
Although BepiColombo shares many commonalities with AOCS design from previous ESA interplanetary mission like Rosetta, Venus Express, and Mars Express, the following peculiarities make the BepiColombo AOCS particularly challenging: S/C modularity: the AOCS has to deal with various composite S/C con-¦gurations, with signi¦cantly di¨erent S/C properties and several sensors and actuators duplicated on MTM and MPO.The S/C attitude in survival and safe mode di¨ers depending on the composite S/C con¦guration; initial attitude acquisition in safe mode: in the harsh thermal environment at Mercury, there would be no time for the AOCS to perform an attitude acquisition from ¤lost in space¥ conditions (e. g., by performing a Sun search using Sun sensors) at safe mode entry.Instead, the last known S/C attitude and dynamics are continuously stored in safeguard memory (SGM) and then are retrieved in case of safe mode entry.Another consequence of the severe attitude constraints is that at safe mode entry, when the S/C is not controlled by the prime OBC due to a reboot, the FCE is taking over control for a few minutes, running a simpli¦ed AOCS software able to damp S/C angular rates and ensure correct Sun pointing; solar array control: owing to technological limitations, the MPO SA cannot be pointed directly to the Sun.Instead, it has to be o¨pointed such that su©cient power is obtained, yet maximum temperature limits are not violated.This is achieved by ground-provided polynomial SA steering pro¦les continuously adjusting the SA position throughout the MPO£s orbit around Mercury; attitude and solar array guidance for safe mode: correct attitude and SA pointing after safe mode entry is crucial for S/C survival.As the orbit around Mercury is left to drift and the margins available are very limited, guidance for safe mode requires frequent updates (about once per week).An error in the updated guidance parameter setting could lead to an end of the mission; and Figure 4 AOCS modes overview: 1 ¡ mode controlled with thrusters; 2 ¡ mode controlled with wheels; 3 ¡ mode controlled with thrusters or wheels; TC ¡ ground commanded mode transition; Auto ¡ autonomous mode transition triggered by AOCS; and CMD ¡ autonomous mode transition triggered by data management system (e.g., due to need to reduce power consumption of AOCS) electric propulsion: BepiColombo is the ¦rst ESA interplanetary mission using electric propulsion.Figure 4 gives an overview of AOCS modes and mode transitions: Standby Mode (SBM): the AOCS is inactive with all units switched o¨.It is used for ground testing and is only entered transiently during §ight (e. g., after safe mode entry); Sun Acquisition and Survival Mode (SASM): ultimate backup mode ensuring S/C survival in case of major onboard contingencies.Attitude control with thrusters only.Initially, the S/C is Sun pointed purely based on ground-provided Sun ephemerides and the last known attitude (propagated in the future by IMU measurements), while Sun sensors and then star trackers are brought into the control loop later on.In SASM, the S/C rotates around the Sun line (in synch with the orbital motion around Mercury when in MPO con¦guration), pointing the MGA such that it sweeps over the Earth once per revolution; Safe Hold Mode (SHM): the S/C is pointed according to ground-provided polynomial pro¦les.At mode entry, attitude control is done with thrusters, while later RWs are brought into the loop.This is the highest mode that may be entered autonomously following S/C safe mode entry.The MGA is pointed permanently to Earth based on ground-provided Earth ephemerides; Normal Mode (NM): nominal operating mode.Attitude estimation and control as in the later stages of SHM.The steerable HGA is used for communications; Orbit Control Mode (OCM): mode for performing trajectory correction manoeuvres using chemical propulsion.Attitude estimation as in NM.For what concerns Failure Detection, Isolation, and Recovery (FDIR), the AOCS employs a layered FDIR concept with sets of local, functional, and global surveillances, aiming at isolating a failure rapidly with the least recon¦guration overhead.
Figure 5 gives an overview of the various MPO and MTM units used by the AOCS.The OBSW implementing all AOCS tasks is running on the MPO OBC, controlling all MPO and MTM equipment.

AOCS OPERATIONS PREPARATION
AT ESA/ESOC

AOCS Operations Preparation Overview
As for other subsystems, AOCS operations preparation by the FCT starts well before launch.The following are the most important preparation activities: preparation of operational products: AOCS §ight operations procedures are written based on input from the S/C manufacturer and later validated against the ESOC simulator and the S/C in dedicated test slots.The industry-provided S/C database is re¦ned and augmented with operations-speci¦c information such as the generation of displays, instantiation of speci¦c TCs, transfer module parameter out of limits, etc.; validation of the interface to §ight dynamics: the §ight dynamics system includes the functionalities for orbit determination, S/C dynamics monitoring, and S/C AOCS-speci¦c commands.Commanding products prepared by §ight dynamics cover a wide range of activities, for instance, guidance for normal and safe modes, RW momentum management, orbit control manoeuvres with chemical propulsion, solar electric propulsion operations, etc.The required precise set of requests is iterated between the FCT and the §ight dynamics team.For BepiColombo, the commanding interface is complex and its validation constitutes a major part of AOCS operations preparation; and testing with the §ight model and engineering model: prior to launch, ESOC has been granted 30 days to perform System Validation Tests (SVT) with the Flight Model.In addition, ESOC can also access the ETB located at the premises of the S/C manufacturer for 30 days to carry out Integrated Ground Space Tests (IGST).Testing activities are carefully prepared and iterated with the S/C manufacturer and the project team at ESA/ESTEC, starting months before a test slot.ESOC performs activities in these test slots with the same ground segment systems as used for §ight, resulting in highly representative test results.For AOCS operations preparation, these test slots are used to validate AOCS §ight operations procedures and operational products provided by §ight dynamics.
In addition, the AOCS S/C operations engineer devotes a large amount of work to the development of the ESOC simulator, ensuring the modeling is §ightrepresentative for all AOCS-related aspects.The Assembly, Integration, and Veri¦cation (AIV) schedule for BepiColombo is such that the MPO is in a more mature state earlier, while the full cruise composite including the MTM will only be completed later.Therefore, AOCS operations preparation at ESOC is initially focussed on MPO stand alone, prior to shifting the attention to MCSC con¦guration, which will have to be operated in the ¦rst 7 years of the mission.

AOCS Flight Procedures and Flight Dynamics Commanding Interface Implementation Status
Work on AOCS §ight operations procedures started in late 2013 and has progressed signi¦cantly in 2014/2015.As for other ESOC missions, §ight operations procedures for BepiColombo are written using the MOIS (Manufacturing and Operations Information System) suite of tools [4].A total number of 290 AOCS procedures is currently expected to be required, out of which 134 have been written, with 78 procedures already run in IGST.
Regarding the commanding interface with §ight dynamics, a total of 263 requests have currently been de¦ned, with the interface control document in a stable state.These requests fall into the following categories: commanding of AOCS units (e. g., star tracker alignment matrices, IMU calibration settings); commanding of AOCS parameters (e. g., mass properties, thruster modulation settings); commanding of ephemerides and guidance in random access memory (RAM) and SGM; and AOCS mode transitions (e. g., entry to OCM, setting all maneuver parameters as required).
The commanding requests for uplink of AOCS ephemerides (Sun and Earth) were implemented in late 2013.Requests for guidance updates for MPO con¦guration were implemented throughout 2014, followed by the same requests for other composite S/C con¦gurations in late 2014 and early 2015.The implementation of essential commanding requests for unit operations (RW management and antennae operations) as well as the implementation of OCM commanding products have started in early 2015 and is planned to be completed prior to IGST-4 in July 2015.

AOCS Closed-Loop Testing on the ESOC Simulator
In late 2013, the ESOC simulator was already capable of running an AOCS closed-loop scenario.As in the early stages of OBSW development, the system initialization process for loading context information from the permanent SGM was not yet ready, the AOCS reference cases were performed by patching AOCS con¦guration and guidance information directly in OBC RAM.As a result, the setup for these reference test cases was not §ight representative.
Therefore, the prime objective in 2014 was to obtain the ability for setting up a closed-loop run based on a custom state vector consisting of epoch, orbital position, S/C attitude, S/C angular rates, with the S/C correctly pointing and having correct guidance information stored in SGM corresponding to this state vector (as for §ight).This is a key step for AOCS operations preparation, as it requires preparation of AOCS guidance products as well as a thorough understanding on how the AOCS and, in particular, the AOCS system initialization process works.For interplanetary missions, this can be intricate owing the sig-ni¦cant amount of consistent guidance information needed by the AOCS to perform nominally, e. g., knowledge on Earth direction to point antennae correctly or ground-provided orbital data.For BepiColombo, an additional complexity is that the AOCS needs context information on the last known S/C attitude and angular rates when entering safe/survival mode.
The following guidance and ephemeris context is required by the BepiColombo AOCS for functioning correctly following a safe/survival mode entry in MPO con¦guration: last known S/C attitude and angular rates (SGM RAM): as described in section 2 and unlike traditional designs, the AOCS does not perform a Sun search/acquisition using sensor data when entering SASM.Instead, it uses context information stored in SGM RAM at 1 Hz when the AOCS was running nominally; Sun ephemerides (SGM Electrically Erasable Programmable Read-Only Memory (EEPROM)): in the early phases of SASM, Sun pointing is estab-lished based on last known attitude, angular rates, and the Sun direction based on ground-provided Sun ephemerides; Earth ephemerides (SGM EEPROM): required for pointing the MGA and HGA to the Earth in SHM and higher modes; MPO SASM attitude and solar array guidance (SGM EEPROM): the SASM attitude guidance speci¦es S/C rotation rate and phasing for the rotation around the Sun line which has to be in synch with the orbital motion around Mercury in order to ensure that the radiator side of the MPO is never facing Mercury.The SASM SA guidance consists of look-up tables with time ranges and commanded Sun aspect angles (SAA), allowing for a stepwise adjustment of the SA position as the S/C rotates around the Sun line; and MPO SHM attitude and solar array guidance (SGM EEPROM): SHM is the highest mode reached autonomously after safe/survival mode entry.For MPO, both attitude and SA guidance are speci¦ed as Chebyshev polynomials.The default attitude guidance for SHM loaded in SGM EEPROM is such that the attitude pro¦le is the same as in SASM.
In summer 2014, a ¦rst successful closed-loop run was achieved on the ESOC simulator, with the procedure involving the following basic steps: (1) a custom scenario is agreed, allowing §ight dynamics to provide the necessary commanding products; (2) the simulator is started with a con¦guration in which the AOCS is in SBM; (3) the last known S/C attitude and angular rates are loaded into SGM RAM, disabling write access beforehand in order to avoid that the information gets overwritten by the AOCS; (4) SGM EEPROM context is con¦gured including AOCS mode transition settings and other essential context such as declaring that the launcher separation sequence has been terminated; (5) the AOCS ephemerides and guidance products are prepared for uplink to SGM EEPROM.This requires time shifting the products according to the desired start time of the closed-loop run.As the mission control system is working in coordinated universal time (UTC), yet the guidance products are generated for the future epoch time, a time correlation between these two times has to be maintained carefully to correctly set up the scenario; and the correlation between UTC and S/C onboard time (OBT).A schematic overview on time correlation activities is shown in Fig. 6; and (6) coordinating on the voice loop, at the agreed time the dynamic simulation was started by AIV in the AOCS SCOE, and ESOC commanded an OBC reboot at the same time.
This setup was successful for the dif- ferent state vectors used on each of the two days.The ensuing testing activities in SASM/SHM/NM were executed successfully, with only minor problems found regarding the procedures or the OBSW.
Figure 7 gives a high-level overview of the IGST-3 test cases.Thanks to the e¨ort spent earlier in 2014, most operations in IGST-3 could be done using actual §ight operations procedures, which is unusual for this early stage of operations preparation.
Each IGST-3 test case is designed to address di¨erent routine and contingency operations expected to be performed in §ight.An example is the guidance commanding in SASM that addresses a critical part of a survival mode recovery.In a typical survival mode scenario, the S/C is expected to be in SASM, with its MGA strobing the Earth in each rotation of the S/C around the Sun line.In such a case, ground would need to be able to stop the S/C rotation, perform small attitude corrections, update the SASM guidance, etc. in order to establish an uninterrupted communication and recover the S/C. Figure 8 shows the operations exercised during the corresponding IGST-3 test case.Figure 8a is the magnitude of the S/C angular rate which is expected to be around 2.6 deg/min for the given test scenario, corresponding to one full revolution of the S/C around the Sun line during one Mercury orbit with a period of roughly 138 min.Figure 8b shows the angle between S/C-Z axis and the Sun direction, which is kept at 6 • in MPO safe mode guidance.The following operations are visible in these plots: (1) Up to Epoch+2700 s: by default, the AOCS uses a coarse attitude control deadband (±2.5 • ) in survival mode to limit fuel consumption, with the SAA drifting within these limits; (2) Epoch+2700 s: a tighter attitude deadband (±1 • ) is commanded.In- §ight, the resulting more precise S/C pointing would increase stability of communications with ground, at the expense of higher fuel consumption; (3) Epoch+3500 s: SASM guidance is updated to introduce about 10 degree o¨set to the reference attitude around the Sun line which leads to an increase in S/C rates.The 10 degree o¨set chosen in the test case was an example.Similar guidance updates in- §ight may be done to adjust for rotational errors in the default SASM guidance used, caused by a drift of the orbit due to thruster usage in survival mode; Figure 8 Spacecraft angular rate and orientation with regard to Sun during SASM guidance commanding on day 1 of IGST-3 (4) Epoch+4500 s: rotation around the Sun line is stopped and then an attitude correction is introduced, which results in a 4 degree o¨set on S/C-Z axis, causing the attitude to leave the deadband.The 4 degree o¨set chosen here was an example.With the rotation stopped, o¨sets of typically smaller magnitude may be commanded in whatever direction necessary to ¦ne tune MGA pointing to the Earth; (5) Epoch+4700 s: attitude correction is set back to zero; (6) Epoch+4900 s: rotation around the Sun line is restarted.Spacecraft rate increases to 7 deg/min to catch up with the commanded SASM guidance; and (7) Epoch+5200 s: 10 degree o¨set is removed which causes the S/C rates to stay below 2.6 deg/min until the new guidance has converged.
Another example for operations tested in IGST-3 are RW activities in SHM, including RW oªoading operations and taking an RW out of the AOCS loop. Figure 9 gives the RW unit (RWU) angular momentum pro¦les and the magni- (1) Epoch+9600 s: wheel oªoading is commanded to remove the excessive RW cluster momentum; (2) Epoch+9750 s: wheel oªoading is completed successfully; (3) Epoch+9750 to 10500 s: the momentum of each wheel keeps increasing although there is no signi¦cant change in the total momentum of the RW cluster.This increase is due to the on board null space management, active whenever all 4 wheels are in the loop.The target null space magnitude was set to 7.5 N•m•s by ground for this test scenario; thus, wheel momentums keep drifting until this target is achieved; (4) Epoch+10500 s: RW4 is taken out of the AOCS torque control loop and commanded in speed mode, i. e., at constant momentum.The null space drift is also stopped with only 3 wheels in the loop; (5) Epoch+10700 s: RW4 momentum is changed to −1.5 N•m•s to see other wheels absorbing the change in its momentum, with the total angular momentum remaining constant; (6) Epoch+10800 s: RW4 is switched o¨, which creates a jump in the total angular momentum as RW4 is not anymore considered a part of the wheel cluster; (7) Epoch+11600 s: RW4 is switched on in constant speed mode; and (8) Epoch+11800 s: RW4 is put back in the AOCS torque control loop.
IGST-3 provided the ¦rst opportunity for the FCT to run a wide range of AOCS operations in a realistic context, using the ETB closed-loop capability.Several more such test slots are coming up in the near future.IGST-4 is planned for July 2015 and will contain a test of all possible AOCS modes and unit operations in MPO con¦guration, including activities not run in IGST-3, the most important of which are orbit control manoeuvres in OCM.Flight dynamics commanding requests are planned to be used more extensively in IGST-4, not only covering AOCS guidance but also unit level operations for RWs and antenna.IGST-4 will also be the ¦rst time AOCS closed-loop testing with the FCE in the loop is planned to be done.The very ¦rst SVT is then planned for the last quarter of 2015, including a rerun of the AOCS operations activities performed in IGST-4.

CONCLUDING REMARKS AND OUTLOOK
The 2018 ESA/JAXA BepiColombo mission to Mercury poses a particular challenge for AOCS operations, with the AOCS controlling a highly complex composite S/C, and strict constraints imposed by the harsh thermal environment leading to complex ground-provided guidance for S/C attitude and steerable mechanisms.
AOCS operations preparation at ESA/ESOC is in an advanced state.Generation of §ight operations procedures for stand-alone operations of the ESA MPO progressed very well in 2014/2015.Given the mature state of the mission control system and the S/C simulator and the ability of §ight dynamics to generate essential S/C attitude and solar guidance products, in 2014 the execution of custom AOCS closed-loop scenarios was achieved.Extensive AOCS testing was performed on industry£s ETB of the MPO S/C in late 2014, executing the complex collaboration activities between AIV and ESOC required for setting up a closed loop run and performing a wide range of AOCS operations.
In terms of future AOCS operations preparation work, several more tests with the engineering model and the §ight model are coming up.Focus will now slowly

Figure 2
Figure 2 shows an artist£s impression of BepiColombo.The combined stack can have the following con¦gurations:

Figure 2
Figure 2 Artist£s impression of the BepiColombo spacecraft in cruise con¦guration (top) with the various elements of the cruise stack in exploded view (bottom left) and the MPO at Mercury (bottom right)

Figure 3
Figure 3 Main elements of the BepiColombo ground segment at ESOC.The ETB will be delivered from industry to ESOC after the launch (SDE/SVF ¡ software development environment / software validation facility; ECC ¡ ESA Tracking Network (ESTRACK) Control Centre)

Figure 5
Figure 5 AOCS hardware architecture

Figure 7
Figure 7 Schedule of IGST-3, ¦rst AOCS-closed loop testing with the ETB in December 2014

Figure 9
Figure 9 Reaction wheels momentum pro¦les (1 to 4) during RW operations on day 2 of IGST-3