Radiation Belt Storm Probes—Observatory and Environments

Abstract

The National Aeronautics and Space Administration’s (NASA’s) Radiation Belt Storm Probe (RBSP) is an Earth-orbiting mission that launched August 30, 2012, and is the latest science mission in NASA’s Living with a Star Program. The RBSP mission will investigate, characterize and understand the physical dynamics of the radiation belts, as well as the influence of the Sun on the Earth’s environment, by measuring particles, electric and magnetic fields and waves that comprise geospace. The mission is composed of two identically instrumented spinning observatories in an elliptical orbit around earth with 600 km perigee, 30,000 km apogee and 10^∘ inclination to provide full sampling of the Van Allen radiation belts. The twin RBSP observatories (recently renamed the Van Allen Probes) will follow slightly different orbits and will lap each other four times per year, offering simultaneous measurements over a range of observatory separation distances. A description of the observatory environment is provided along with protection for sensitive electronics to support operations in the harsh radiation belt environment. Spacecraft and subsystem key characteristics and instrument accommodations are included that allow the RBSP science objectives to be met.

1 Introduction

The National Aeronautics and Space Administration’s (NASA’s) RBSP mission is a dual observatory mission depicted in Fig. 1 that will study variations in solar activity and how this affects the earth’s environment as well as human activities in space and on the ground. This will improve our overall knowledge of the radiation belts and how they respond to solar storms and events. Particles are accelerated to form the radiation belts in unpredictable ways, and scientists need better observations to develop new and improved models of this important aspect of the Earth’s environment. The observatory instruments will measure high- and low-energy electrons and protons, ion composition, and electric and magnetic fields using the Energetic Particle Composition and Thermal Plasma Suite (ECT), the Electric and Magnetic Field Instrument Suite (EMFISIS), the RBSP Proton Spectrometer (RPS), the Electric Field and Waves Instrument (EFW) and the RBSP Ion Composition Experiment (RBSPICE).

Fig. 1

RBSP is a low-risk and affordable mission, consisting of two identical observatories, built to survive in the radiation belt environment and to fully achieve all of the RBSP science objectives

The sections that follow describe the baseline RBSP observatory designed by engineers at the Johns Hopkins University Applied Physics Laboratory (APL). Key mission and Observatory design drivers include the following.

Mission Requirements

• Orbit with an apogee of 30,500 km and perigee of 600 km, maximizing time in the radiation belts.

• Provide twin observatories identically instrumented.

• Launch both observatories on a single launch vehicle.

• Design for a mission life of 2.25 years with a goal of 5 years.

• Provide near-continuous transmission of space weather.

Observatory Requirements

• Operate through the challenging radiation environment.

• Provide attitude control through spin stabilization to provide required instrument fields of view; observatory is nearly Sun pointed, with nominal spin rate of 5.5 revolutions per minute (rpm).

• Provide power system to operate through eclipses up to 114 min.

• Downlink an average daily data volume of at least 6.61 Gbits of recorded plus real-time data per day during the operational phase of the mission.

• Accommodate significant payload mass (130 kg) and average power (149 W).

• Provide deployed science booms for fluxgate and search coil magnetometers.

• Provide deployed axial and wire radial booms for electric field measurements.

The two observatories are positioned and phased such that one will lap the other approximately four times per year. Each observatory is designed for an on-orbit life of 2 years and 74 days. This encompasses a 60-day commissioning period post launch, a 2-year science mission, and 14 days at the end of the mission to passivate the observatories. Observatory passivation includes a delta-velocity (ΔV) maneuver to lower the perigee and a precession maneuver to orient the solar arrays away from the Sun; each observatory will be disposed of via uncontrolled atmospheric re-entry within 5 months. The 2-year science mission lifetime provides sufficient local time, altitude, and event coverage to improve the understanding of, and determine the relative significance of, the various mechanisms that operate within the radiation belts and their individual and collective effects.

The RBSP observatories (renamed the Van Allen Probes by NASA on November 9, 2012) were launched together on a single Atlas V-401 Evolved Expendable Launch Vehicle (EELV) from Kennedy Space Center on August 30, 2012. The launch vehicle spun up, oriented each observatory so that the solar arrays pointed toward the Sun, and released each observatory separately. Both observatories are operating in highly elliptical orbits that will spend a substantial part of the mission life in the Van Allen radiation belts. The two orbits have apogee altitudes between 30,050 and 31,250 km, perigee altitudes between 500 and 675 km, and inclinations of 10^∘ (Stratton and Fox 2012).

Each RBSP observatory operates independently in a spin-stabilized mode at a 4–6 rpm nominal spin rate with the spin axis nearly Sun pointed and maintained between 15^∘ and 27^∘ off pointing from the Sun, with 4 deployed solar array panels and 8 deployed instrument booms. Four 50-m spin plane booms provide AC and DC electric field measurements, two 6-m axial booms (12-m tip-to-tip) provide three-dimensional electric field measurements, and two magnetometer booms extend an additional 2 m beyond the solar array panels. Figure 2 shows the observatory in a fully deployed configuration, and Figs. 3 and 4 depict the observatory bus with accommodation of the instruments and their respective fields of view (FOVs). The spinning observatory sweeps the instrument apertures and sensors on the booms through 360^∘ to obtain measurement samples as a function of angular direction.

Fig. 2

RBSP observatory in fully deployed configuration

Fig. 3

Observatory configuration showing instrument fields of view

Fig. 4

Detailed instrument fields of view from observatory aft perspective

1.1 Payload Accommodation

The RBSP science objective is to investigate how populations of relativistic electrons and ions in the radiation belts form and change in response to variable inputs of energy from the Sun. The mission targets the fundamental processes that energize, transport, and cause the loss of these charged-particle populations. These particles are in and around the Earth’s radiation belts and are hazardous to observatory and astronauts. The investigations and instruments selected by NASA for each RBSP observatory measure particle distributions, fields, waves, densities, and other parameters with sufficient fidelity to answer the most pressing outstanding scientific questions regarding the behavior of the radiation belts (Sibek et al. 2006; Ukhorskiy et al. 2011). Each observatory will carry a hardware complement to support five science investigations and instrument suites identified in Table 1, along with their associated payload resource allocations. A detailed description of these instrument suites and their components and measurements is provided elsewhere. The main focus of this paper is to describe the spacecraft and accommodations for these science instruments.

Table 1 RBSP science payload

1.2 Observatory and Spacecraft Configuration

A description of the observatory with a focus on spacecraft subsystems is included below and addresses how key mission characteristics and the environment drove the design solution. The observatory resources including mass and power are summarized in Table 2 and demonstrate a design that meets RBSP science needs and provides margin for observatory contingencies. Figure 5 provides an overview of the functional elements including interfaces and connectivity between the spacecraft and instrument components. The RBSP observatory onboard avionics computer is based on a radiation-hardened RAD-750 single board computer manufactured by BAE Systems with 16 megabytes (MB) of random access memory (RAM) plus a 16 gigabit (Gb) synchronous dynamic random-access memory (SDRAM) data recorder. The observatory interfaces are controlled by an RTAX2000 field-programmable gate array (FPGA).

Fig. 5

RBSP observatory block diagram

Table 2 RBSP observatory resources

The observatory supports continuous operations of all of the instruments. Power is supplied by four deployable solar panels, supplemented by an eight-cell lithium ion battery. The observatory will support the critical loads for at least 7 days in safe mode to provide sufficient time for the mission operations team to diagnose and resolve faults. The extreme radiation environment, combined with project cost constraints and the NASA risk classification (Class C), drove several unique features within the RBSP fault management system which is discussed in detail in the fault management section below.

The design philosophy for each observatory is to keep the observatory as simple as possible to reduce cost and to reduce the development and test schedules while meeting the science objectives. This philosophy is enabled by the mission science requirements, which drive the observatory to be a Sun-pointed spinner. Attitude knowledge and ephemeris are not required onboard. There is no onboard closed-loop guidance control system. Maneuvers and attitude adjustments are performed via thruster commands. Attitude determination is performed on the ground, after post-processing of downlinked Sun sensor and EMFISIS fluxgate magnetometer data. To support this ground-based attitude determination, the observatory components are placed and balance masses are located so that the observatory will produce less than 1^∘ error of spin axis relative to the observatory frame. The measured uncertainty of the Sun direction relative to the observatory frame is ≤1.024^∘ (3σ, single axis). This includes sensor and alignment errors, but not timing and processing errors, which are addressed separately. Contributions to alignment uncertainty knowledge include static alignment knowledge <0.2^∘ (3σ) and dynamic alignment knowledge <0.09^∘ (3σ). The attitude knowledge budget is shown in Table 3. Due to the spin and offset communications antennas, RBSP also has the redundant capability of using RF Doppler data to provide spin axis estimations (Srinivasan et al. 2012). Each RBSP observatory has the means (i.e., hardware, software, and expendables) to support orbital maneuvers throughout the commissioning, operational, and disposal phases of the mission, with a total ΔV of more than 150 m/s. This provides for translational maneuvers (collision avoidance, observatory separation distances/lapping rates, de-orbit), as well as for precession maneuvers that will be performed to keep the spin axis oriented towards the Sun with an overall attitude knowledge of 3^∘.

Table 3 Attitude knowledge budget

The observatory provides a broadcast message of observatory spin phase and spin period to each instrument at a frequency of 1/s. The observatory provides a spin pulse, from the Sun sensor when available, or a spin pulse based on a hardware timer, when Sun sensor pulse is unavailable, to each instrument approximately once per spin. This is described in Sect. 10, which goes into detail about the Guidance and Control System.

The observatory solar array 3.2-m² total area will provide adequate power over the life of the mission to operate all onboard science instruments as long as the observatory is oriented with the arrays pointed to the Sun at an angle between 15^∘ and 27^∘ of normal. The observatory is spin stabilized to maintain this configuration, and the guidance and control systems will provide attitude correction maneuvers to maintain the spin axis and the arrays toward the Sun within these limits.

The observatory design includes a 50 Ah onboard battery that provides power to the observatory during the 2.5-h launch eclipse duration before the solar arrays deploy. The battery also is sized to provide observatory power during the mission to support full science operation through daily orbit eclipses that will vary throughout the mission for a given launch date. The longest eclipse duration is 114 min for the RBSP orbit, assuming launch any day of the year. The observatories will operate autonomously during solar eclipses and will continue to collect science data, transmit during scheduled contacts, and continuously transmit space weather data. Onboard fault management functions will monitor and transition the observatory to safe mode if needed as discussed in detail in Sect. 3 on fault management below.

The radio frequency (RF) system includes an APL-built Frontier radio transceiver and solid-state power amplifier that provides 8 W S-band RF transmitter power. The observatory RF system includes an S-band antenna on top (+Z) and bottom (−Z) observatory decks transmitting simultaneously. Because the antennas have broadbeam patterns, there is an interferometer pattern around the observatory in which no communications are planned. This exclusion zone is shown in Fig. 6; the observatory will transition through these short exclusion zones (hours) during each orbit. The observatory-to-ground communication link provides the capability to transmit all science and housekeeping data with a 1-hour pass per day for each observatory after commissioning. Therefore the impact is minimal to work around those portions of the orbit that do not support communication with the RBSP observatory. The system supports operation at up to 2 Mbps and is described below in Sect. 5.

Fig. 6

Antenna boresight (mast) angle vs. range; each point represents 15 min of contact time The National Aeronautics and Space Administration’s

The observatory coordinate system is shown in Fig. 7 and is defined as follows. The X–Y plane is parallel with and contains the launch adapter interface. The Z-axis extends from the center of the adaptor ring, normal to the X–Y plane and runs through the central cylinder. The +Y direction extends from the Z-axis in the direction of the centerline of the solar array supporting the EMFISIS fluxgate magnetometer. The +X direction is set relative to the other axes by the application of the right-hand rule. For the nominal mission attitude the +Z direction will be pointed close to the Sun line and the direction of positive rotation for each observatory is defined by the application of the right-hand rule about the Z axis.

Fig. 7

Spacecraft coordinate system

The EMFISIS search coil and magnetometer field of views are shown in Fig. 8 relative to the observatory XYZ coordinate system for reference.

Fig. 8

EMFISIS instrument fields of view and boom-mounted locations

There is also a science UVW coordinate system defined for the mission that is related to the observatory XYZ coordinate system as a −35^∘ rotation about the observatory +Z axis, with the +W direction aligned with the observatory +Z direction. The origin of the UVW coordinate system lies in the plane of the EFW spin plane booms (SPBs) at the intersection point of the EFW axial boom (AXB) deployment axis. The +W direction is aligned with the center line of the forward EFW AXB. The +U direction is aligned with the nominal location of EFW SPB #1. The +V direction is relative to the other axes by the application of the right-hand rule, aligning it with the nominal location of EFW SPB #3. The science coordinate system is shown in Fig. 9. This figure also depicts the instrument field of views for the observatory body-mounted instruments including the HOPE, RBSPICE, REPT, RPS, and MagEIS instruments. The relative instrument views are shown in Fig. 10.

Fig. 9

Science coordinate system

Fig. 10

Relative instrument fields of view

2 Observatory Environment

An RBSP design driver is the severe environment in which the RBSP observatories will spend the majority of their time: each observatory is designed for the challenging environmental requirements imposed by its orbit in the Van Allen Radiation Belts. The risk to electronic hardware is high. The environment causes high total ionizing dose and single event effects due to radiation as well as surface charging and deep dielectric charging/discharging on electrical hardware. Since RBSP is mostly single-string, several passive fault management features are designed into the system to deal with these environmental effects. First, additional shielding is utilized around electronics boxes. Second, a radiation-hard parts program is employed in which devices were tested to at least 50 krad (Si), with the required hardness based on chassis wall thickness and use of spot shielding. All integrated circuits were required to be latch-up immune. Third, first circuit interfaces are hardened to survive deep dielectric discharge pulses in the observatory harness. Fourth, in order to enable sensitive RBSP science measurements, the observatory is designed using techniques to reduce observatory internal and surface charging so that the observatory-generated fields will not contaminate the electric fields and magnetic fields that the science instruments will be measuring.

Significant effort was expended in the design of the observatory to minimize non-conductive external surfaces that could charge up and generate electric fields contaminating EFW measurements or experience discharges that could damage observatory electronics. Also magnetic material was restricted and current loops were either eliminated of minimized to avoid generating magnetic fields that could contaminate EMFISIS measurements. The required error due to the observatory-generated electric field at the tip of the axial booms is ≤4 mV/m. To meet this requirement, all exposed surfaces of the observatory are grounded, and internal to the observatory there are no floating metal conductors or large dielectric surfaces. Electromagnetic interference (EMI) backshells are used on all internal harness connectors, and all harnesses are wrapped with an aluminum tape outer wrap. In selective cases lead overwrap was added to electrical harnesses that connect to components that are sensitive to deep dielectric discharge events. Unused pins in the observatory harness are grounded and bleed resistors are included for umbilical and launch vehicle connections that would be left floating after the observatory disconnects from the launch vehicle. Special care was given to the design of the solar arrays, as these extend from the observatory body and are closer to the boom-mounted sensors. The solar arrays use solar cells with a grounded indium tin oxide (ITO)—coated coverglass and also incorporate a double layer of insulating grout covered by conductive grout and dissipative black Kapton tape over solar array interconnects. To reduce the magnetic signature of the solar array, the strings were designed carefully to reverse adjacent polarities and thereby cancel out magnetic fields for each panel. The RBSP solar arrays provide the necessary observatory power while nearly eliminating extraneous electric and magnetic fields. SAIC completed a study for APL, which predicted a spurious electric field contribution of less than 1.6 mV/m generated at the EFW axial boom sensors, assuming 8 % of the solar array area would be nonconductive. Since the solar array design actually achieved a performance of less than 1 % nonconductive array area, the expected array-generated spurious electric field will be significantly below the predicted 1.6 mV/meter (Davis et al. 2007). Electromagnetic Compatibility (EMC) tests were conducted on each observatory demonstrating that the observatory generated electric field is below 24 μV/m over the frequency range of 30 Hz to 400 kHz.

The RBSP observatory-generated time domain magnetic field is required to be less than 5 nT static and 0.1 nT dynamic over the frequency range of 50 Hz to 15 kHz at the EMFISIS fluxgate and search coil magnetometer locations on the booms. To meet this requirement the use of magnetic material was restricted and care was taken in all designs to minimize current loops and other effects that could generate magnetic fields. A test program was instituted consisting of testing at the part, box, and observatory levels. Magnetic cleanliness was a high priority throughout the development effort. The static magnetic field produced by the solar array has been measured and is ≪1 nT at 0.5 m thus it is well below the required performance to support mission science measurements. The static magnetic field of each observatory was measured during the observatory magnetic swing test performed at APL in the environmental test facility in January 2012 and again just prior to launch in July 2012. This testing provided a measured static magnetic field below 4 nT and dynamic magnetic field below 0.1 nT.

2.1 Radiation Environment

The observatory and instrument subsystems and components are required to operate continuously while the RBSP observatory transits through the heart of the inner trapped-proton Van Allen belt twice every ∼9-h orbit for the nominal 2-year + 74-day mission. These energetic protons (up to hundreds of megaelectron volts (MeV)) provide the majority of the penetrating dose and all of the displacement damage. The second major contribution to the total radiation dose is from the outer belt trapped electrons that bombard the observatory during the long exposures near apogee. An analysis was done to determine the corresponding total dose versus shield depth for the RBSP mission from SHIELDOSE box-level generic geometry results. All parts used in the RBSP observatories were specified to survive a total ionizing dose of at least 34 krad (Si) [23 krad (Si) for the integrated electronics module (IEM)] without parametric or functional failure. This value is based on a 2-year (plus 74-day) life, with a radiation design margin (RDM) factor of 2, and a nominal shield depth of 350 mils (500 mils for the IEM) of aluminum. As mentioned previously, radiation parts testing was performed at an even higher level, 50 krad, on parts that were not already specified by the vendor to handle that level of radiation.

After the RBSP observatory mechanical configuration was designed and defined, a detailed radiation transport ray trace analyses using NOVICE code gave specific results for individual electronics boxes and locations. The maximum dose for any box was 15,400 rad (RDM=2). Table 4 shows predicted results for RBSP observatory mounted assemblies. The large number of 350-mil wall boxes provides substantial shielding for nearest neighbors on the observatory and reduce the electronics box doses to minimal levels from the most penetrating protons.

Table 4 Total ionizing dose (RDM=2)

Connector cutouts in the chassis were shielded to prevent localized high ionizing doses inside electronics boxes. This shielding was inside or outside of the electronics box. The expected low to moderate accumulated total doses of 23–34 krad (Si) behind 500 mils and 350 mils aluminum, respectively, eliminated the need for enhanced low dose rate (ELDRS) testing.

Solar panels and instrument optics or exposed detectors must withstand displacement damage associated with the trapped proton fluence. For the 2-year + 74-day RBSP mission the equivalent 1-MeV electron fluence is 1.35×10¹⁵ e/cm² behind 20-mil cover glass thicknesses for the maximum power parameter on the solar cells. Figure 11 shows the expected 10 MeV equivalent proton fluence as a function of shield depth in aluminum. For the box wall thicknesses of 350–500 mils, the fluences are in the range of 5×10¹⁰ to 8×10¹⁰ p/cm².

Fig. 11

Equivalent 10 MeV proton fluence vs. shield depth

The estimated deep space cosmic ray integral linear energy transfer (LET) spectra for the RBSP orbit were used to estimate the upset rates of single event effects (SEEs) for the mission. The deep space spectra are relevant but conservative for the RBSP mission, since the observatories spend the vast majority of the time at or near geosynchronous altitudes, where the deep space environment applies. The “Worst Week” environment curve is generally used in upset rate calculations. It must be combined with the experimentally determined upset cross-section for a given device to calculate the upset rate.

Parts susceptible to single event latch-up with linear energy transfer threshold less than 80 MeV cm²/mg were not used in RBSP systems. A failure modes and effects analysis (FMEA) was performed to demonstrate that other single event upsets (SEUs) in parts would not cause mission critical failures. SEUs in parts of noncritical systems were not allowed to compromise flight system health or mission performance.

Critical digital parts (i.e., programmable devices, memories, and microprocessors) were evaluated for susceptibility to SEU effects, such as single- and double-bit errors, functional interrupt and stuck bits. Critical linear and mixed signal devices were evaluated for proton-induced single event transients (SETs). Power devices were analyzed for single event burn-out (SEB) and single event gate rupture (SEGR).

The peak proton flux expected in the RBSP orbit has been calculated and is 1.0×10⁶ protons/cm² s with energy greater than 10 MeV; the peak electron flux is 3.7×10⁷ electrons/cm² s with energy greater than 1 MeV. These peak fluxes produce the maximum dose rates and noise caused by charged particle hits during the RBSP orbit, which may affect dynamic integrated circuit performance, guidance and control sensors, and science instrument resolution. Hardware must operate through these levels.

2.2 RBSP Parts and Materials Radiation Test and Evaluation

An extensive parts radiation test program was implemented as part of the RBSP project to evaluate radiation performance of key radiation sensitive components. Parts were evaluated for total ionizing dose based on the predicted mission dose levels and SEEs were predicted based on single event latch-up and single event functional interrupt performance (Tipton et al. 2009).

Total ionizing dose (TID) testing was performed at 18–25 rad/s in the APL cobalt 60 Irradiator on about 50 part types that were proposed for use in the RBSP flight hardware. The remaining part types were either purchased as radiation-hardened devices or evaluated to be hard to the TID requirements by manufacturers or third party data. Displacement damage testing of optocouplers and linear regulators was carried out at the Indiana University Cyclotron Facility (IUCF) with 200 MeV protons in October 2007, October 2008, and June 2009. No passive parts testing was performed. Bipolar transistor screening in March 2009 showed that only the 2N2222 needed to be purchased as a radiation-certified part. Six other bipolar transistors passed 100 krad: 2N2369, 2N4957, 2N2857, 2N2907, 2N3501, and 2N3700.

SEE testing was conducted using heavy ion runs for latch-up, SEFIs, SEUs, and transients in July 2008, December 2008, and March 2009 at the Brookhaven National Laboratory Tandem van de Graaff accelerator. Several digital-to-analog converters (DACs) and frequency synthesizers were evaluated for use in the APL RF transceiver. Proton upset of the RTAX2000 FPGA static random access memory (SRAM) was completed at IUCF in August 2009, and the components for the RF transceiver were evaluated in June 2009. Upset rates for the RF transceiver and solid-state recorder (SSR) were computed and deemed acceptable. Proton transient tests for linear regulators and power converters were also conducted at IUCF in October 2008, June 2009, and April 2011.

In addition to the supporting the testing of observatory components, APL supported evaluation and testing of the following parts and materials for the science instruments:

• Total dose testing for materials on the EFW booms.

• Proton-induced radioactivity in shield materials for RBSPICE and ECT.

• Bipolar transistor results for several instruments.

• Consultation on HV801 optocoupler/driver for ECT.

• Displacement damage work on optocouplers for ECT.

• Single event testing for latch-up and transients for ECT and EFW.

• The results of SEU testing of FPGA SRAM blocks were provided to the instrument teams.

Materials investigations included several total dose evaluations and conclusions:

• ITO-coated silverized Teflon in a self-supporting thermal blanket configuration lost all mechanical integrity and was in pieces after 10 Mrad, which was the estimated surface total dose.

• The same material when structurally supported by a plate of aluminum in a radiator configuration passed the 10-Mrad level with respect to mechanical integrity. However, the ITO coating’s electrostatic discharge (ESD) conductivity was destroyed.

• Germanium black Kapton in the thermal blanket configuration survived the 10-Mrad exposure with only some minor discoloration in isolated locations and no visible degradation in mechanical integrity and surface conductivity and was chosen for thermal control applications.

• External wire insulation for solar panel wire and the EFW SPB passed testing successfully.

• EFW AXB cable from Gore and the EFW painted and plated external materials all passed testing successfully.

• Purge tubing passed radiation exposure test successfully.

• Silicone oil for the nutation damper showed ∼7 % increase in viscosity at −20^∘ C temperature after radiation exposure.

• Several RF antenna mockups with coax cable performed well under radiation exposure test.

Tungsten/copper, tantalum, and 364 stainless steel disc samples were exposed by the Laboratory for Space Physics (LASP) ECT team for induced radioactivity at Brookhaven National Lab to a simulated RBSP orbit proton spectrum. 90/10, 80/20 tungsten/copper and tantalum had no sustained significant radioactivity. The 364 stainless steel had only a minor long-term response.

2.3 Electromagnetic Environment

The electromagnetic environment (EME) for RBSP includes all effects of the environment from initial design and parts selection through mission operation. This includes the normal observatory electromagnetic compatibility with launch radar and other equipment. It also includes magnetic control for the magnetic field measurements, electrostatic control for the charged particle detectors, and low-frequency electric field measurements, as well as internal charging control to assure all devices survive and operate properly in the radiation belt plasma environment. Of these four EME areas, the internal charging issue was the most critical to the observatory design, since electrical discharges due to internal charging of dielectrics or floating conductors could actually damage electrical hardware and cause mission failure.

High-energy electrons and ions in the radiation belts will penetrate the outer structure of the observatory and come to rest inside the spacecraft. The flux of ions that penetrate the observatories is small and gives rise to radiation issues discussed previously. However, the electron flux in the energy range of 0.1 to 10 MeV in particular is large enough to accumulate substantial charge in dielectric materials and floating conductors. Figure 12 shows an integrated spectrum plot of the log of the number of electrons that strike every square centimeter of the observatory every second verses the energy of these electrons. If the charged particle stops in an active circuit, the operational current will carry the charge to ground. However, when the charged particle stops in an insulator or floating conductor, the charge cannot return to ground and accumulates. If the observatory is not properly designed, both conductor and dielectric material can charge up to several thousand volts. When sufficient charge accumulates in an object so that the local voltage exceeds the breakdown voltage of the dielectric or the gap voltage of a floating conductor, a discharge to the local ground occurs. A discharge is a flow of electrons that results in a negative pulse when the discharge is directly into a circuit, but circuit properties or the movement of image charges can cause a positive or ringing pulse. If the local ground is a trace on a circuit board connected to an ESD-sensitive circuit, damage can occur. But even if damage does not occur, the electric discharge creates an electric field pulse inside the device that can upset circuits, inject noise in communications, or contaminate low voltage signals.

Fig. 12

Electron spectrum

Floating conductors will neutralize the entire charged volume of the conductor in one discharge, producing a high-voltage, high-energy pulse that can easily damage circuits and upset distant circuits from the large electric field pulse. Large exposed dielectric surfaces will also discharge most if not all exposed surface in one discharge. For this reason, floating metal and large dielectric surfaces were not allowed anywhere on the observatory unless shielded with enough metal to prevent charging.

Dielectrics covered with thin layers of conductors or in immediate contact with a conductor (such as the insulation on a wire) can discharge and cause ESD-like damage and can also create EMI noise. But the discharge is limited to a local volume of dielectric due to the high relative resistivity preventing electrons from moving through the material to sustain the discharge. This limits the energy of the discharge, producing a lower voltage and larger resistance for the discharge. All devices and harnesses had to be specially designed with extra shielding and discharge protection to not only survive these discharges but to operate while these multitudes of discharges are occurring. Special care was taken to assure no segment of harness was left open, causing the wire to become floating metal. All of this required special circuitry in some situations, additional shielding over some cables, and the use of large drain resistors to connect to ground in other circuits.

Since discharges in the harness are unavoidable, all first circuit interfaces have to survive these discharges. A test program was instituted to evaluate a variety of interface ICs and protection circuits. The test program utilized standard ESD testing using the Human Body Model ESD event, since this ESD test is more damaging than the expected deep dielectric discharge pulses in the observatory harness. A unique aspect of this test was that devices were tested in the powered and unpowered states. First circuit interfaces were selected based on this testing or in some cases based on analysis. The selected interfaces will survive deep dielectric pulses; however, most input interfaces will pass the pulse to the next stage of electronics. To ensure that this pulse did not affect operability (e.g., be detected as a command, or corrupt a command in transit), the use of a pulse rejection circuit was required. These circuits were typically located in an FPGA for digital interfaces.

Low-energy particles in the radiation belt plasma stop and accumulate on the outer surface of the observatory, causing the second EME issue of observatory charging. Surfaces in sunlight emit electrons due to the photoelectric effect. These two effects come to equilibrium by charging the observatory to a voltage different from that of the local plasma until the two currents balance. If sections of the observatory are not electrically connected, large potential differences can develop. These potential differences can lead to discharges, but at a much lower value they contaminate both the electric field and particle measurements required by the mission. The observatory must be a “grounded” local reference frame in the plasma so that the science instruments can measure the DC and low-frequency electric fields and low-energy particle spectra. This required all outer surfaces to be conductive and bonded together, as well as surfaces inside the observatory, since a multitude of medium-energy electrons make it through the observatory body but lose enough energy to stop on the inside surfaces. One of the crucial requirements was to find conductive black paint and conductive adhesives that would meet the electrical, thermal, and mechanical requirements of the observatory.

A detailed charging model of the observatory was developed and used to finalize surface charging requirements as the development of the observatory progressed. Major effort was put into the development of the solar panels, since they represent a very large area close to the sensitive instruments. Extreme care had to be taken to make sure that the conductivity requirements did not interfere with the function and isolation requirements of the arrays.

To perform the mission, the observatories had to survive assembly, integration, and testing in environments where static electricity is possible. Standard ESD control procedures for assembly and testing of deliverable hardware and minimum standards for ESD safeguards related to observatory assembly, inspection, test, transport, and storage of flight and spare hardware were defined for the project.

The third EME issue is magnetic control. As part of the science instruments, each RBSP observatory carries a triaxial fluxgate magnetometer (MAG) which measures the Earth’s vector magnetic field and a triaxial search coil magnetometer (SCM) which measures the magnetic field associated with plasma waves in the radiation belt. MAG and SCM are extremely sensitive devices with wide dynamic range necessary to measure both small deviations in the field and off-axis fields to determine field and propagation direction. Due to the wide dynamic range, the MAG and SCM instruments are sensitive to magnetic fields generated by the observatory. Of particular concern is the increasing use of low-voltage parts that pull substantial currents when active. These circuits will turn on for a while, drawing large currents with possible high-frequency modulation, and then turn off. This on–off cycle can create low-frequency magnetic fields that can interfere with science measurements. The feed and return circuits on circuit boards had to be carefully laid out and inspected to minimize the area inside the closed current loop from the power supply to the part and back. Special segmentation of power and return planes was necessary to minimize magnetic emissions by reducing the loop area.

Any electrical interfaces with an unbalanced current flow would generate magnetic fields that could interfere with science measurements. Therefore single-ended electrical interfaces were not allowed; only balanced differential interfaces were used, generally with a shielded twisted pair harness configuration. Digital interfaces between observatory electronics used low-noise low voltage differential signaling (LVDS) circuits. There would have been some advantages to using a MIL-STD-1553 bus, but the high level of emissions that have been measured on MIL-STD-1553 interfaces precluded its use.

Another major magnetic control area was the solar arrays, especially the +Y solar array, because the MAG was attached to this panel. A piece-wise linear magnetic circuit model based on a model from Goddard Space Flight Center (GSFC) and an APL magnetic moment model were used to guide the design. All the solar cells were laid out in U-shaped strings with the return current loop on the back surface of the panel back-tracking the current flow through the solar cells to achieve magnetic compensation. To further reduce the magnetic emissions, neighboring strings were wired in opposite directions, i.e., one string clockwise and the adjacent strings counter-clockwise. Measurements were made of every string individually to verify that the front and back currents were in the proper direction and relation to adjacent strings. A final test where the entire array was driven with a realistic square wave current was performed to verify the total cancelation of the design. For all panels, the measured magnetic field amplitude was at or below the 1-nT detection threshold. The solar arrays are shown in Fig. 13 during observatory integration and test with solar array protective covers installed for use during ground processing.

Fig. 13

RBSP Observatory A and Observatory B side by side in APL test facility with solar array protective covers

Since magnetic cleanliness was a major concern, magnetic measurements of every device began during the development stage which identified some materials that were replaced with nonmagnetic alternatives. This testing continued as components were installed on the spacecraft, and culminated in a final observatory-level test to determine the total signature of the assembled observatory. Of particular concern were motors, latch valves, and strong magnets in particle instruments. Because the Earth’s magnetic field varies by a factor of about 200 over the orbit, the use of magnetic shielding material had to be carefully controlled, as this material would drag the Earth’s field along with the observatory and contaminate the science measurements. Early measurements during development identified that the particle instruments did not need the shielding due to their careful design. The SPB motors did need the shielding, but again, careful design eliminated any problem. Latch valves are necessary in the propulsion system and they must have a magnet to function; early measurements identified the need for a compensating magnet to be installed in the observatory near the latch valves to reduce the field to acceptable levels at the science instrument.

The final EME area of concern is meeting the standard EMC requirements for the observatory. No device may interfere with the operation of any other device or with the launch vehicle, and all devices must also survive interaction with launch radars and radios. These requirements were assigned to every device. Verification started in the development stage and continued to measurements made when each device was installed on the spacecraft, with a final observatory-level EMC test which finished with a “plugs out” test of the fully operating observatory in a configuration as close to flight-like as possible.

The MIL-STD-461-C test requirements were tailored for this mission and every device type went through full qualification testing as well as a reduced set of acceptance tests. Because two observatories were built, there were at least two of every device plus (for many devices) a flight-like engineering model (EM) was built. When the EM was nearly identical to the flight model (FM), the qualification testing was done on the EM so that any identified problem could be fixed in the FM and re-tested. This greatly helped to avoid scheduling issues, preventing a flurry of activity on a device just before delivery if an EMC problem was identified.

Since magnetic cleanliness was so important, the radiated emissions RE-01 tests were tailored for the measurement requirements and for the distance a device was from the SCM on the observatory. The RE-01 magnetic field emissions test limits are shown in Fig. 14 for a distance of 3–5 m from the observatory. Because distance was not a major factor in the low-frequency electric field tests there was one specification for all devices, which was tailored to the measurement requirements of the science instruments. A critical problem in RBSP science is that electric fields in the plasma vary from DC to hundreds of kilohertz, requiring electric field measurements below the normal minimum RE-02 frequency of 14 kHz. The APL EMC chamber was specially modified to make measurements down to 50 Hz, and most devices had to use this facility since commercial chambers could not make the measurement below 14 kHz. To control emissions at these low frequencies, conducted emissions CE-01 measurements were acquired on breadboards and power supplies to aid in the device design and tailor filter and board designs. CE-01 and CE-03 measurements were acquired on every device before delivery and again after installation on the observatory to look for interaction problems with actual harness and power systems. Identified problems were reworked and retested.

Fig. 14

Radiated emissions RE-01 magnetic field emissions limits for 3 to 5 m

Conducted and radiated susceptibility (RS) tests were also performed to tailored limits for the RBSP Mission. RS levels were specified at one level for operation and at a higher level for survival. Many devices opted to test for operation at the survival level to reduce test time and only a few had any problem, but everything did pass both levels. Due to the probability of ESD from internal charging, every device at the prototype level was tested for susceptibility to nearby ESD discharges and passed; however, not all the ground support equipment operated properly during the test.

2.4 Magnetic Testing

During observatory development, significant care was taken to ensure the magnetic cleanliness of all observatory components, either procured or developed for RBSP. All observatory electronics boxes were measured and found to be acceptable prior to installation on the observatory. Magnetic materials were prohibited for use on RBSP, and all components were tested prior to installation to ensure that they did not carry a residual magnetic field. The only component on the observatory that is magnetic is the latch valve in the propulsion system, for which there was no non-magnetic alternative. Compensation magnets were installed on each observatory to cancel the latch valve magnetic field.

A magnetic swing test was conducted during observatory-level integration and test to measure the static magnetic fields of the fully integrated RBSP observatory bus in an unpowered configuration. The purpose of this test was to confirm the residual magnetic field in order to separate the observatory-induced field from the natural in-space environment. The test configuration is shown in Fig. 15. Magnetic field data were collected and the observatory magnetic moments determined to confirm that the residual permanent magnetization is within the observatory allocation. The solar panels were measured separately and their performance was also verified as acceptable.

Fig. 15

Observatory magnetic swing test configuration

The RBSP total observatory generated time domain magnetic field is required to be less than 5 nT static and 0.1 nT dynamic (from 15 Hz to 15 kHz) at the boom-mounted magnetometers which extend 3 m each from the observatory main body. The static magnetic field produced by the solar array panels was measured to be ≪1 nT at 0.5 m and is well below the required performance to support mission science measurements. The solar array magnetic testing was performed jointly with the APL EMC engineers and the GSFC magnetometer team. The solar array strings were driven with a square wave current, either separately, or together, to facilitate identification of a magnetic field due to the solar arrays (string plus compensation loop) in the presence of a variable environmental field. The test demonstrated that the RBSP solar array is very well compensated, with little or no statistically significant field observed as close as 0.5 m from the array. This indicated that the solar arrays will well exceed requirements, particularly allowing for the separation of the arrays and the flight sensor positions.

To test the observatory main body, each RBSP observatory was suspended from a crane in the APL high bay facility for a magnetic swing test using only verified nonmagnetic materials in the mechanical test configuration. Simultaneous measurements with sensors at different locations permit the first order removal of background variations. Two magnetometers were used in gradiometer mode for each measurement to subtract the Earth’s field and background noise by taking the difference of the readings between the two magnetometers. An initial translational measurement was made to measure the dependence of the observatory magnetic field with distance and then a rotational measurement was made to determine the angular dependence of the static field. During the test each observatory was suspended from the crane directly under the hook and allowed to swing back and forth with a translational motion, and later rotated about a fixed axis at a fixed position such that measurements were acquired continuously over a 360^∘ rotation.

The observatory magnetic swing tests verified that there were no major sources of magnetic field other than the latch valves and the compensation magnet on each observatory at the time of the test. The test also verified that the compensation magnets for both observatories were installed properly so that they cancel the magnetic field of the propulsion system latch valve at the EMFISIS magnetometer sensors. The EMFISIS sensors are located on booms that extend approximately 3 m from the body of the observatory. Based on the magnetic field measurements made during the swing test at 1.5 m, combined with the measurements done on the solar arrays, the magnitude field at the location of the sensor is estimated to be 3.71 nT for Observatory A and 3.63 nT for Observatory B, both are below the stated DC goal for magnetic cleanliness of 5 nT. Based on analysis, the dynamic magnetic field is determined to be less than 0.1 nT over the frequency range of 50 Hz to 15 kHz. Additional measurements were made just before launch to verify the observatory magnetic cleanliness in the final flight configuration after shipment to the launch site.

3 Fault Management

The RBSP observatories have a single-string fault tolerant architecture. Critical single-string spacecraft components use un-switched power and have the ability to be power cycled (or “off-pulsed”) in the event that a radiation induced failure causes a fault that requires removal of power. Critical boxes can be off-pulsed individually or as a group. Both software and hardware command loss timers are part of this off-pulse architecture and result in a power cycle of observatory electronics if a specific command is not received for a defined duration. The off-pulse architecture is described in more detail below.

The RBSP fault management system is a distributed system with allocations to observatory hardware, flight software, rule-based autonomy, and ground/mission operations as depicted in the fault protection operational modes diagram in Fig. 16. The RBSP fault management design uses both “active” and “passive” features to deal with potential faults. Some of these features were included to mitigate faults induced by the environment. Active features include actions taken onboard the observatory that are implemented with hardware, software, or a combination of the two, whereas passive features include design decisions and development practices to minimize the probability that a fault occurs. The overall goal was for the onboard fault management system to be as simple as possible while ensuring that (1) the observatory is capable of detecting, correcting, and recovering from any single, recoverable anomaly that affects the health and safety of the observatory and (2) the observatory meets the overall mission concept and mission goals.

Fig. 16

Fault protection modes diagram

While allocations were made to hardware, flight software, ground/mission operations, many of the onboard fault detection and responses were allocated to autonomy. The RBSP rule-based autonomy system uses a traditional monitor-response style architecture. It consists of over 70 monitors and responses that autonomously address observatory faults. The type of protection varies, such as powering off loads that draw excessive current (software circuit breakers) to more complex system-level responses such as initiating a safe mode sequence if a pre-defined failure is detected autonomously. The latter response involves a series of load-shedding actions wherein the observatory is configured into a power-conserving state that supports emergency RF communications with the Earth. The autonomy system is also used for selected operational responses not directly tied to faults. These include sensing observatory separation from the launch vehicle and commencing the critical post-separation sequence which enables safety-inhibited observatory buses, powers on the RF system, and deploys the solar panels to acquire power. Although the autonomy system executes within the flight software, the individual monitors and responses can be modified without changing the underlying flight code. Since the observatory is operating in a dynamic radiation environment, this approach provides the engineering team with flexibility to quickly modify or augment the autonomy system in response to unexpected behavior that may be observed in flight.

While the RBSP fault management design takes advantage of inherent mission design characteristics to reduce complexity, a number of design drivers also influence the design. The near-Sun pointed, spin-stabilized design offers a number of advantages, while the extreme radiation environment, project cost constraints, and the NASA risk classification drive several unique features within the fault management system. These influences on the design resulted in five high-level principles that governed the overall RBSP fault management design and from which lower-level fault management concepts and requirements were derived. These high-level principles include selective fault tolerance, minimized onboard fault management, layered fault management for maximum science, limited instrument fault management, and off-pulse capability for unswitched electronics. The result of applying these five principles was a simplified observatory with a fault management design aimed at reducing complexity while at the same time increasing the probability of success.

The NASA risk classification for the mission, as defined by the Risk Classification for NASA Payloads (NASA 2008) influenced several of the high-level principles. The RBSP mission is categorized as a Class C mission, which is defined as a medium-to-low cost mission, with medium-to-low complexity, and accepts a medium level of risk. In addition, Class C missions may use single string and selectively redundant design approaches, and critical single point failures (for Level 1 Requirements) may be permitted but are mitigated by use of high-reliability parts, additional testing, or other means. The Class C designation drove both the overall system design and the fault management system, with the program adopting a selective fault tolerance philosophy to maximize reliability while minimizing cost and complexity. This resulted in a single-string architecture for RBSP, incorporating passive fault management measures to increase the reliability of critical sequences and to reduce the use of parts with high risk of failure, with failure modes that are more likely due to the environment, or parts with movable components. Table 5 summarizes the selective fault tolerance implemented on RBSP.

Table 5 RBSP selective fault tolerance

In addition to the use of passive features such as the radiation-hard parts program, additional box shielding, etc. to protect against the harsh radiation belt environment, a unique active fault management feature was devised to mitigate against the effects of discharges inside boxes. Since RBSP uses a single-string architecture, critical components [i.e., the IEM, Power Distribution Unit (PDU), and Transceiver (XCVR)] are powered using unswitched power services so that they cannot be turned off once the observatory is powered (devices on switched power can be power cycled by ground command). These components are described in more detail later in this paper. However, the extreme mission radiation environment can induce faults in these components that can only be cleared by the removal and re-application of power (termed off-pulsing). The fault management system implements an off-pulsing capability for unswitched electronics to clear faults in the XCVR, IEM, and PDU. Mechanisms were provided to allow off-pulsing of any single component as well as simultaneous faults in all three of these components. As shown in Fig. 17, all off-pulse requests are routed through the PDU, with the PDU implementing a specific hardware command sequence for each off-pulse type. The off-pulse mechanism was designed to be fault-tolerant with a single fault resulting in, at most, a single off-pulse cycle.

Fig. 17

Top-level off-pulsing architecture

The fault management architecture utilizes the following off-pulse requests: IEM request to off-pulse transceiver (via software command loss timer [SWCLT]), transceiver request to off-pulse IEM (via RF critical command decoder (CCD) command), transceiver request of off-pulse PDU (via RF CCD command), and hardware command loss timer (HWCLT) request to off-pulse PDU, IEM, and transceiver. Both the software and hardware command loss timers are reset using a specific command; if that command is not received for a defined duration, an off-pulse of the transceiver occurs (in the case of SWCLT expiration) and an off-pulse of the PDU, IEM, and transceiver (in the case of HWCLT expiration). Table 6 summarizes the components to be off-pulsed, the source of the off-pulse request, and the trigger for the off-pulse.

Table 6 Sources and targets of off-pulsing

The severe environment and mission science requirements also influenced the design principle layered fault management for maximum science data collection. An important aspect of the science measurements is to obtain simultaneous observations over a range of observatory separations to distinguish between spatial and temporal variations. To meet these science measurement goals, the RBSP fault management system, in the event of a fault, utilizes a layered fault management design for maximum science data collection, which ultimately defines the fault management modes. Faults are categorized by severity with the goal of quickly detecting and responding to less severe, isolated faults with minimum interruption to science data collection (i.e., remain in operational mode) and ensuring a power-safe and communication-safe observatory for more severe, time-critical faults through a system-wide response (i.e., demote to safe mode).

While the design philosophy for the observatory and fault management is to keep the observatory as simple as possible to reduce cost, as influenced by the risk classification, this philosophy is made feasible by the mission requirements for the observatory to be pointed toward the Sun and to be spin-stabilized. The near-Sun pointed attitude is the only attitude required to collect the prime science measurements and maintaining it requires only periodic precession maneuvers every ∼21 days for the duration of the mission. The periodic precession maneuvers are dictated by the Earth’s orbital motion around the Sun, with maneuvers being performed when the total Sun offset angle reaches a maximum value. This orbit offers a number of design advantages: (1) when combined with antenna coverage out to 70^∘ from both sides of the spin-axis, frequent ground contacts (more than one per day) with negligible communication delays are possible; (2) the near-Sun pointed attitude ensures adequate power generation when attitude is maintained within the maximum offset angle; and (3) the inherently stable spin state requires infrequent adjustments to maintain the observatory’s orientation, allowing for open-loop attitude control. The inherently stable observatory with open-loop attitude control system and frequent ground contacts allow for a minimized onboard fault management system (as compared with more complicated missions with 3-axis stabilized attitude control), with the burden for fault correction and recovery to be placed on the ground. This design principle encompasses the overall safing concept for the mission and defines the fault management modes. To reduce the complexity of the fault management system, the goal was to have the least number of modes possible to safely perform the RBSP mission. By design, the RBSP observatories are in a “safe” state: they are inherently stable, near-Sun pointing spinners which require only periodic attitude precession maneuvers performed via an open-loop attitude control system.

Two modes have been identified for RBSP, operational mode and safe mode, which is consistent with the fault management philosophy principle of layered fault management for maximum science data collection. Operational mode is the primary mode for the observatory and is used from launch through the end of the mission unless the observatory encounters a life-threatening fault condition. When possible, the observatory “flies through” faults or “fails operational,” meaning that noncritical faults leave the observatory in operational mode. These faults are handled by the onboard fault management system or by the ground during subsequent ground passes. The occurrence of a critical fault [defined as a hardware or software low voltage sense (LVS), low battery state of charge (LBSOC), violation of the maximum Sun angle, or extended loss of communication (HWCLT)] causes a transition to safe mode. The goal of safe mode is to autonomously place the observatory into a known communication-safe, power-preserving configuration so that the ground has time to identify and recover from the fault. The transition from safe mode back to operational mode is performed by ground command only.

Finally, onboard fault management is also significantly reduced because there is no onboard capability for the guidance and control subsystem to autonomously point the observatory, and the observatory and science instruments are decoupled. When possible, fault management measures are allocated to hardware to reduce the size of the onboard rule-based autonomy. When fault management measures are allocated to autonomy, the dedicated rules take simple actions such as powering off a component or resetting a component. This leads to the last design principle: limited instrument fault management. The RBSP observatory fault management is decoupled from the science instruments, with instrument fault management limited to the monitoring of instrument power draw, power down request, and heartbeat. In the event of an instrument fault, the instrument is immediately powered off with no advanced warning; however, all other instruments remain powered on to maximize the science data collection.

4 Power System

Each RBSP observatory utilizes a direct energy transfer (DET) power system topology which simplifies observatory electronics and minimizes power system–generated EMI. The power bus voltage varies with the eight-cell Li-ion battery voltage. The RBSP power system consists of the power system electronics (PSE), the battery management electronics (BME), the solar array junction box (SAJB), the 50-Ah Li-ion battery, and four deployed solar array panels. A simplified block diagram of the power system is shown in Fig. 18.

Fig. 18

Simplified block diagram of the RBSP power system

The power system electronics consist of a single fault-tolerant 16-stage sequential analog voltage control shunt regulator with maximum battery current limit. The loads are connected to the single 8-cell, 50-Ah Li-ion battery via the PDU. The nominal bus voltage is 30 V and can vary between 24 and 32 V depending on the state of charge (SOC) and temperature of the battery. Each battery cell can be by-passed with a bypass switch, activated by ground command, to remove a single cell from the battery in case of a pending cell failure. If bypass switch activation has occurred, the corresponding bus voltage range becomes 21 to 28 V. The primary battery charge control method is constant current followed by a constant voltage taper charge (CC/CV). The battery is charged at a high rate, limited to C/5, where C is the battery capacity, using the available solar array power that is not used by the loads until the battery SOC reaches 60 %. The onboard coulometer then reduces the battery charge current to C/10. The battery maximum voltage is controlled to preset safe levels via voltage (V) limits that are implemented in the single fault tolerant voltage regulator. Whenever the battery voltage reaches the V limit, the V control loop will force the charge current to taper.

The battery management electronics consists of an interface board and a cell shunt board. Each battery cell has a parallel-connected analog shunt used during the mission to balance the end of charge voltage of each Li-ion battery cell. Each cell shunt is limited to 0.75 A maximum current bypassed around the cell in order to limit the amount of power dissipated in the BME. The BME contains eight relays that allow the battery cells to be disconnected from cell shunts to limit leakage current during ground operations or whenever the BME is not powered. During safe mode operation, the current controller and BME are not powered and the system relies on the single fault tolerant voltage limit regulator. The average observatory load power during flight is expected to be 277 W.

4.1 Solar Array

The RBSP solar array consists of four deployed panels with a total active area of 3.2 m². Each panel is approximately 0.739 m wide and 1.26 m long. The panel substrates are 25.4-mm-thick aluminum honeycomb with composite face sheets. The panel front cell side is insulated with Kapton, co-cured with the graphite fiber face sheet. The back face sheet is not painted. Three different solar cell sizes are used to maximize the cell packing density. Each panel contains 12 strings of 24 series connected 28.3-cm² solar cells. The panels without booms panels (two panels of the four) contain an additional two strings of 22 series connected 26.62-cm² solar cells and four strings of 22 series connected 11.5-cm² solar cells. The panels with booms (two panels of the four) contain an additional string of 22 series connected 26.62-cm² solar cells and two strings of 22 series connected 11.5-cm² solar cells. The solar cells are triple junction cells with a minimum efficiency of 28.5 % (BTJ), from EMCORE Photovoltaics. The cover glass on each cell is 0.5-mm-thick cerium-doped microsheet, from Qioptiq with ITO coating. Figure 19 shows the solar array panels for both RBSP observatories ready for observatory integration.

Fig. 19

RBSP solar array panels ready for observatory integration

The RBSP mission instruments required that more than 85 % of all array surfaces be conductive with exposed potentials at spacecraft ground. To achieve this, the cell side is grouted with two-layer grout and two-layer tape over all interconnects. The wires on each panel backside are shielded. The shields were connected to the face sheet at regular intervals using conductive adhesive and are electrically connected to the aluminum honeycomb core with conductive epoxy at the connector bracket. The wiring on the cell side is not shielded but is covered with conductive grout. The solar panel temperatures are sensed using PT103 platinum wire sensors, placed beneath the solar-cell-side face sheet in small bored cavities. To minimize the magnetic field induced by the currents in the strings, the strings are laid down in a U pattern and back wired. Roughly, every other string is placed with the current polarity in the opposite direction to further cancel any residual magnetic field.

4.2 Battery

The RBSP observatory battery as shown in Fig. 20 was designed and built at APL. The battery contains eight Li-ion cells, LSE-50, that were manufactured by GS YUASA. Bypass switches from NEA, Inc., were placed across each cell to eliminate the potential of an observatory failure caused by a cell where the performance is diverging from the majority of the pack. The bypass switch is a make-before-break design with the switch performed activated ground command. The battery is required during launch, eclipses, and maneuvers, and to support the solar array power during peak power transients and guidance and control (G&C) Sun off-pointing anomalies. The battery package includes connect relays and temperature transducers. The voltage of each cell is monitored with the voltage and temperature signals reported by the BME.

Fig. 20

Flight battery after completed vibration testing in preparation for observatory integration

4.3 Power Distribution

The power distribution unit provides switched, unswitched, and pulsed power to the observatory components; the allocations of the switched, unswitched, and pulsed power services and rate power levels are shown in Table 7 (spacecraft components) and Table 8 (instrument components). The PDU receives primary power from the PSE and has a serial universal asynchronous receiver/transmitter (UART) command/telemetry interface with the IEM. The PDU box is a modular slice design. Each slice consists of a printed circuit board housed in a mechanical frame, and the slices stack and bolt together. The slices are electrically connected using internal rigid-flex connectors for signals. A wiring harness external to the box is used for power connections. A solid 350-mil-thick aluminum chassis and solid 150-mil aluminum radiation shields (located in thinned areas of the PDU chassis) are used to mitigate the effects of radiation on the electronics parts and allow the PDU to function nominally in a high radiation environment.

Table 7 RBSP observatory power services

Table 8 RBSP instrument power services

The PDU is shown in Fig. 21 as installed on the interior of an observatory side panel. The PDU includes power metal–oxide–semiconductor field-effect transistor (MOSFET) switches for the load power services. For hazardous functions, such as thrusters, deployment actuators, and RF transmitters, electromechanical relays are used to “arm” the safety-critical power busses. Additional power MOSFETs are used in series to provide a sufficient quantity of inhibits to meet range safety requirements. Majority-voting of separation signals is used to control one of the inhibits. Mechanical safe/arm plugs were employed during integration and test. Switched power services include a circuit breaker function implemented in the switch control circuit that makes use of current monitors and power MOSFET switches. The circuit breakers can be individually enabled and disabled. To protect the main power bus, each load power service also has an upstream fuse. These fuses are type FM12A, which are of solid-body construction and have no cavity. These high-reliability fuses have significant spaceflight heritage and are rugged with respect to mechanical vibration and shock.

Fig. 21

Power distribution unit (PDU) installed on Observatory A panel

The PDU functions are shown in a bock diagram in Fig. 22 and include the fault protection hardware sequences. The PDU has eight hardware sequences stored in programmable read-only memory (PROM), which are utilized by the fault management system; these sequences contain the hardware responses to critical observatory faults and off-pulse requests. Both the LVS and LBSOC detections result in load shedding via hardware sequence. In addition, the off-pulse architecture is implemented by the PDU with a specific hardware command sequence for each off-pulse type. If a fault is detected in any critical observatory component (i.e., PDU, IEM, or XCVR); an off-pulse request can be issued by the nominally functioning component to off-pulse (power cycle) the component with the fault. This off-pulsing architecture also includes the capability to off-pulse all three critical components via HWCLT expiration in the unlikely event that all three are simultaneously subjected to fault conditions. Finally, the PDU also features a power-on-reset circuit with an autonomous initialization sequence to ensure that loads are in an appropriate pre-defined power state following bus voltage recovery in the unlikely event of a bus undervoltage.

Fig. 22

PDU block diagram

5 Telecommunications system

The RBSP RF telecommunication system has three primary functions: (1) provide a downlink for science data and observatory telemetry return, (2) provide an uplink for observatory commanding, and (3) provide highly accurate Doppler data for observatory navigation (Srinivasan et al. 2009). The RF system operates at S-band, with separate uplink and downlink frequencies for observatories A and B. The RF system is sized to enable downlinking of at least 6.7 Gbits of data per day per observatory, including real-time housekeeping telemetry and adequate margins, during the operational phase of the mission. To meet data return requirements given the constraints of the mission system, the RF system provides data rates up to 2 Mbps. The data rate is optimized during a ground contact as the link parameters change due to the changing observatory range to the ground station.

The 10^∘ inclination of the RBSP orbit places the ground track in the region indicated in Fig. 23. To provide adequate ground tracking of the observatory, three geographically diverse stations are used. The APL 18-m dish in Laurel (APL-18), Maryland, USA, is the primary ground antenna (Copeland et al. 2010). This ground station provides sufficient performance and view periods to adequately downlink the required mission science data nominally on a daily basis. At S-band, the 18-m dish provides 49.5 dB of antenna gain with a system noise temperature of 135 K. To augment these contacts, secondary ground antennas are selected to provide additional coverage for circumstances such as launch and early operations, emergencies, and periods of poor geometry to APL-18. These antennas are the Universal Space Network (USN) 13-m ground stations at South Point, Hawaii, USA, and Dongara, Australia. The telecommunications system is also compatible with the Tracking and Data Relay Satellite System (TDRSS).

Fig. 23

Ground station locations and their fields of view at the RBSP apogee distance. At closer distances the coverage area diminishes; however, the closer distance enables a higher downlink rate for increased data volume throughput

A block diagram of the S-band RF communication system is shown in Fig. 24. The major components include two low-gain antennas, a power combiner/divider, a diplexer, an 8-W solid-state power amplifier (SSPA), and a Frontier radio transceiver (XCVR) to interface with the observatory avionics subsystem. The antennas, SSPA, and Frontier radio were all designed and built by APL. Conical bifilar helix antennas (Stilwell 1991) provide the broad-beam −4 dBic gain coverage required for the mission and are shown in Fig. 25. The S-band Frontier radio, shown in Fig. 26, consists of four slices: an exciter, receiver, Digital Signal Processor (DSP), and power converter. The receiver and exciter slices contain the RF hardware for the uplink and downlink respectively. The DSP slice supplies the central control of the transceiver and enables the transceiver to function as a software-defined radio. This compact design provides state-of-the-art mass (1.8 kg) and power (<9 W full duplex) for the offered capability (Haskins and DeBoy 2007; Haskins et al. 2006, 2010; Haskins and Millard 2010; Crowne et al. 2011; Millard and Haskins 2011).

Fig. 24

RBSP RF subsystem block diagram

Fig. 25

The RBSP mission requires broad-beam antenna coverage from boresight to 70^∘ for each antenna. The antenna is shown on the right with and without a radome

Fig. 26

The RBSP flight Frontier radio transceiver

The RBSP XCVR includes special protections to mitigate the extreme radiation environment. There is 350-mil shielding around all the radio and SSPA electronics to minimize the total dose experienced by the internal electronic, electrical and electromechanical (EEE) components. Further, several risk reduction techniques are employed in the radio firmware to mitigate single-event upsets including register refreshing, error checking and correcting, device resetting, safe control circuit design, and watchdog timers. Further, system-level communication protocols such as Command Operations Protocol Number 1 (COP-1) and Consultative Committee for Space Data Systems (CCSDS) File Delivery Protocol (CFDP) are employed to optimize proper data transmission.

The various communications modes used in the communications system are described in Table 9. Uplink bit rates include 2,000 bps (nominal) and 125 bps (emergency). Since there is more than 20 dB margin at the nominal uplink bit rate, emergency communications to ground stations are not an issue assuming nominal ground station and observatory antenna performance. Downlink bit rates include 2,000, 1,000, 500, 250, and 125 kbps (science) and 1000 bps (emergency and space weather). Specific parameters are provided in Table 9.

Table 9 RBSP mission communications mode presets

Each RBSP observatory includes two S-band RF antennas: a forward (FWD) antenna, located on the top deck, and a back (AFT) antenna located on the bottom deck to provide coverage in both observatory hemispheres as shown in Fig. 27. There is a 40^∘ gap in coverage around the observatory center caused by the interferometer pattern between the antennas. The FWD and AFT RF antennas are fixed, mounted at a radius of 9 in. (23 cm) from observatory spin axis, and they extend 10.15 in. (25.8 cm) above the separation interface plane. The antenna field of view (FOV) is 70^∘ half angle. The two observatory antennas use different polarization which allows for tracking from a single ground station at the same time and simplifies ground operations; Observatory A uses right hand circular polarization (RHC) and Observatory B uses left hand circular polarization (LHC). The antennas are located off-center of the spacecraft, which allowed the two spacecraft to stack on top of each other for launch without mechanical clearance issues.

Fig. 27

Antenna field of view

Figure 28 and Table 10 show how the supportable downlink bit rate changes as a function of range. Because the downlink data rate is continuously optimized to account for the widely changing range, only the fixed parameters are presented in Table 10. Three encoding modes are utilized: APL-18 (turbo encoding only), and USN-13 (turbo and convolutional encoding). The baseline plan is to use turbo encoding (rate=1/2) for all science downlink passes to ground stations. The observatory supports rate=1/2 convolutional encoding as a backup mode. There is no ranging requirement for RBSP. For all science modes (lowest rate of 125 kbps), a minimum downlink margin of 3 dB is required. Assuming similar ground station and observatory antenna performance, the margin for the emergency rate of 1 kbps is well above the 3-dB requirement to ground stations.

Fig. 28

Supportable science downlink rate vs. range assuming a 3-dB downlink margin. Solid curves represent the downlink rate with the specified antenna gain of −4 dBic over the entire field of view. Dotted line represents the enhanced downlink capability when the antennas are used from 0^∘ to 50^∘ from their boresights

Table 10 Maximum ranges for given downlink rate for each link condition

The RBSP observatories are navigated via processing of the RF Doppler data acquired during all ground contacts with the APL 18-m and the USN 13-m ground antennas. In all downlink modes, the observatory XCVR emits a coherent S-band downlink, the frequencies of which are recorded by the ground station Cortex receivers. The frequency measurement meets the required navigation accuracy of 5 mm/s over a 10-s integration period. This performance was ultimately verified during observatory-level thermal-vacuum compatibility testing with both the APL and USN ground networks.

6 Observatory Avionics

The avionics subsystem comprises the hardware command and data handling (C&DH) functions in a single spacecraft bus component, the Integrated Electronics Model (IEM). The IEM is a card cage design based upon the 6U Compact PCI (cPCI) form factor. The IEM chassis and external radiation shields encase the box electronics in aluminum at 500 mils (nominal) thickness. A detailed block diagram of the IEM and its external interfaces is shown in Fig. 29.

Fig. 29

Integrated electronics module (IEM) block diagram

The IEM consists of five cards connected across a common backplane. A 32-bit PCI bus, clocked at 16.5 MHz, connects the single board computer (SBC), solid-state recorder (SSR), spacecraft interface card (SCIF), DC-to-DC converter, and telemetry cards for flow of commands and telemetry. The SBC is a BAE RAD750-based design clocked at 33 MHz for 50 MIPS (nominal) with 16 MBytes of SRAM, 4 Mbytes of electrically erasable read-only memory (EEPROM) and 64 Kbytes of PROM. The SSR contains 16 Gbits of synchronous dynamic random access memory (SDRAM) with error detection and correction (EDAC) and hardware scrubbing. The selected SDRAM has a low upset rate (even in the RBSP environment); the few SDRAM errors that are expected will be corrected by SSR EDAC. The SCIF card contains a custom FPGA design that implements interface logic and thruster control. The board also houses the observatory precision oscillator, which is used for generation of mission elapsed time (MET). The DC–DC converter card provides regulated secondary voltages derived from the spacecraft primary power bus and implements the box off-pulse capability. The telemetry card gathers temperature, analog, and discrete data and is connected to the SCIF card via an internal I2C bus.

While the RAD750 is not expected to reset as a result of environmental effects, there have been cases where processors have reset due to unexpected uncorrectable errors. If no mitigation steps were taken, a processor reset could result in the loss of data stored on the SSR and a halt in the recording of science data. To prevent this, the fault management system includes autonomy rules that will preserve SSR contents and re-enable the recording of science data in the event of a processor reset.

The IEM handles both commands to each instrument and telemetry and science data flow from each instrument via 115.2 kbaud UART links. The UARTs are synchronized to the observatory timekeeping system via a one pulse-per-second (1 PPS) interface. Commands to the instruments and other spacecraft bus components are sent out via two sequenced transmission buffers with the delay from 1 PPS dependent upon the prior command buffer usage. The two groupings are PDU, PSE, XCVR, EMFISIS, EFW, RBSPICE and RPS; and HOPE, REPT, MAGEIS Low, MagEIS 35, MagEIS 75, MagEIS High and the spacecraft real-time telemetry monitor (telemetry output for ground use only). The peak instrument science and telemetry data rate is permitted up to the full 115.2 kbaud rate, effectively 83 kbps per instrument. The IEM is shown installed on the observatory in Fig. 30.

Fig. 30

IEM installed on Observatory A

An electrically-isolated function within the IEM is the hardware command-loss timer (HWCLT) utilized as part of the fault management off-pulse architecture. This is a discrete, logic-based circuit that maintains a countdown between successive “reset” pulses from the ground. If the HWCLT is not “reset” by a specific command sent from the ground within 3.58 days, a logic pulse is sent to the PDU which initiates a PDU sequence to off-pulse the PDU and then off-pulse the IEM and XCVR. As with all off-pulse implementations, there are multiple levels of protection on this action including an inhibit feature within the PDU itself and two physical interfaces to each box being off-pulsed. The 3.58 day duration is set based upon other fault management mitigation events such as a software based command loss-timer and specific actions initiated through the ground.

7 Flight Software

The APL-developed custom RBSP command and data handling (C&DH) software consists of a set of functional applications and libraries that are designed to be used with the GSFC core Flight Executive software, which provides standard application services, and the VxWorks operating system, hosted by the RBSP observatory IEM single-board computer (Reid and Monaco 2012).

The onboard RBSP flight software provides the following functionality: command uplink, spacecraft command management, autonomy rule processing, command macro management, spacecraft time-tag command management, SSR management, telemetry management, downlink management and managing the hardware interfaces to instrument and observatory hardware.

Telecommand code blocks are received at a data rate of 2 kbps during normal operations or at a rate of 125 bps for emergency operations. The C&DH software retrieves these code blocks from the SCIF over the PCI bus and reconstructs telecommand packets from the code blocks. Telecommand packets are distributed to the instruments via the SCIF hardware or to the C&DH command management software based on the telecommand packet’s application identifier.

Observatory command packets that are received by the C&DH command management software are validated, prioritized, and sent for execution to the appropriate C&DH software application. Command sources are real-time commands, commands from a real-time command to execute a macro, commands that execute as a result of a time-tagged rule firing, and commands that execute as a result of an autonomy rule firing. Allowed priorities for spacecraft commands are 0 (highest) to 15 (lowest). One command can execute every 40 ms (25 Hz). The command that executes in a given cycle is the highest priority command awaiting execution. Commands execute chronologically within a particular priority level. Before a command is executed by the C&DH software, its parameters are validated.

The C&DH software manages the loading and memory management of command macros. Command macros are a sequence of stored commands that execute in response to a real-time command, the firing of an autonomy rule or the firing of a spacecraft time-tagged rule.

The C&DH autonomy rule engine manages loading and processing autonomy rules, computed telemetry equations, and storage variables. Autonomy rules are evaluated each second and provide the ability to execute a command when a logical expression evaluates to “true” for “n of m” seconds. The logical expressions consist of operands and operators where the operands are either constants or entries in the data collection buffer (DCB). Similarly, computed telemetry equations are logical expressions that are evaluated once per second where the results of the evaluation (numeric or boolean values) are made available as inputs to autonomy rules (through the DCB). Finally, storage variables are a means of providing memory to the autonomy system.

The C&DH spacecraft time-tag command management software provides the ability to load, store, and evaluate time-tagged rules. Once per second, the MET associated with each rule is compared to the spacecraft MET; if the rule MET is greater than or equal to the spacecraft MET, the command associated with the rule is delivered to the C&DH command management software for execution. The C&DH subsystem provides storage for instrument time-tagged commands. As instrument commands are received by the C&DH subsystem, time-tagged instrument commands are recognized and stored in a buffer. Once per second the C&DH subsystem checks the instrument command buffer for commands ready to be sent to the instrument. At the appropriate time the CCSDS command packet is transferred to the instrument. The C&DH telemetry management software outputs all spacecraft telemetry in variable length CCSDS-formatted telemetry packets. These packets contain the MET of packet generation. The software provides modifiable tables that control the rates and prioritization of real-time spacecraft and instrument telemetry packets sent to the downlink software.

8 SSR Data Management

The RBSP observatory is capable of simultaneous data collection, recording, and playback/downlink, and includes a 16 Gbit SDRAM data recorder. The SSR is designed to retain data during a non-power-cycling (i.e., soft) reset. Flight software SSR management functions are designed to automate data collection and storage and to minimize operations complexity for configuring the system to control the downlink of stored science and engineering data.

The flight software uses a file system to store data on the SSR. Each instrument and spacecraft component has been assigned an onboard data storage allocation. Because instruments for the most part produce data at a continuous data rate (despite some variation based on orbit position or radiation belt activity), each instrument is given an SSR data volume allocation corresponding to the amount of data produced per day based on the daily average bit rate. An exception is the burst data produced by the EMFISIS instrument when a significant radiation belt event is detected. While the concept of operations is to downlink 24 hours of science survey data each day, burst data is instead stored in a 3.5 Gb buffer that is downlinked at a lower priority than other science data over the course of up to 7 days. Data allocations are given in Table 11.

Table 11 Observatory data allocations

Under nominal operations, 24 hours of stored science data are downlinked every day. However the SSR is sized to provide the capability to store observatory housekeeping data for the number of days equivalent to the time-out duration of the HWCLT heartbeat monitor, which provides a time-out period of 3.58 days. Similarly, the SSR allocations for instrument data are sized to store data for 2.5 days to preserve science and housekeeping data until ground contact is successfully reestablished. This meets the requirement to provide instrument data storage sufficient to account for at least 1 day of missed ground contacts.

All instruments and spacecraft components natively produce science and housekeeping data in the form of CCSDS packets. The C&DH flight software collects the packets and routes them into files on the SSR that are stored in one of three directories which in turn represent downlink priority. Uploadable tables and parameters configure the flight software to specify which packets are stored in each file, the directory it is to be stored in, the maximum size for each file type, and the maximum data volume allowed for each source. This allows for completely automated onboard data collection and storage. For normal operations, flight software also automatically creates the file names, incorporating observatory time into the name as well. As the software routes packets into a file, it monitors the file size and closes it when the maximum size is reached, then automatically opens a new file of that type to continue storing packets without interruption. Flight software limits the maximum SSR data volume for each source by monitoring the total current volume for all stored files (science + housekeeping). If a data source reaches its maximum quota, flight software will delete the oldest stored file from that source upon opening a new one. Reported in status telemetry provided to each instrument is the current percent utilization of its SSR data volume quota. Thus, if so desired, an instrument can be configured to cease producing packets when the data quota limit is reached, thereby allowing for a “stop when full” behavior rather than having old data get discarded and overwritten.

Flight software provides additional automation to simplify downlink operations, in the form of an SSR playback manager. Upon the start of a ground contact, stored commands enable the playback manager. This software scans the directories on the SSR and automatically selects for downlink the oldest file in the highest priority directory, moving onto the next file in priority order as required to keep the downlink bandwidth fully utilized. The three directories containing files to be downlinked represent, in priority order: (1) spacecraft housekeeping, events and history, instrument housekeeping, and EMFISIS MAG data; (2) survey science data from all instruments; and (3) EMFISIS burst data. Once a file has been successfully downlinked, it is automatically deleted to recover SSR space.

To minimize data loss or the need to retransmit data lost due to RF dropouts, the flight software utilizes the CCSDS File Delivery Protocol (CFDP) during the downlink of files from the SSR. This protocol provides an “FTP in space” capability and is managed by CFDP client software resident in both the flight software and the ground system software. Flight software packs SSR file data into protocol data units which in turn are placed into CCSDS frames for transmission to the ground system via the spacecraft downlink hardware. A virtual channel identifier indicates to the ground that the received frames contain SSR file data. CFDP client software in the ground system recognizes if any protocol data units have been lost during downlink, and in turn automatically generates control directives on the uplink that are received by the flight CFDP client. The flight software then retransmits only the missing protocol data units. This two-way handshaking between flight and ground software is automatic within the CFDP clients, and apart from the ACK/NAK of protocol data units, also provides an indication of when the downlink of a file is finished and it is fully intact. Flight software then deletes the source SSR file. The flight software supports the downlink of telemetry frames at nominal rates of up to 2,000,000 bps. If the Mission Operations Center (MOC) is using a ground station with insufficient bandwidth to support two-way handshaking on the ground links, CFDP can be configured to downlink files in a best-effort mode. In either event, the ground system receives data files in the exact native format used when they were stored on the spacecraft SSR. Thus a simple Level-0 ground software processing step readily prepares files with packets sorted in time order. The files are placed on a server in the MOC and made available to each of the instrument Science Operations Centers.

9 Observatory Time Management

The RBSP timekeeping system provides knowledge of the correlation between time onboard the observatory and time on the ground. Central to this task is the principle of providing an onboard time reference to which the times of all other events on the observatories are referred, including the times of observations by the science instruments. Since the two RBSP observatories do not communicate with each other in any way, there is a separate timekeeping system associated with each observatory. The two observatory timekeeping systems are identical except for behavioral parameters such as clock drift rate.

Time is represented onboard the RBSP observatory using a composite hardware counter called mission elapsed time (MET). This is the standard term that has been used on many APL missions such as MESSENGER, New Horizons, STEREO, Solar Probe Plus, and NEAR. Non-APL missions often use other terminology to refer to this function, such as the SOHO on board time (OBT). Other terms in common use include spacecraft clock (SCLK). However, RBSP and other APL missions use the term “spacecraft clock” to refer to the time that is supplied by the C&DH subsystem to the science instruments. The RBSP MET composite counter consists of two parts. One part, called iMET or IMET, represents the integer number of seconds since the start epoch of midnight (00:00:00 UTC) on January 1st, 2010. The second part, called vMET or VMET, represents sub-seconds in units of clock “ticks,” each such tick lasting 1/50,000th of an IMET second, or about 20 ms. This tick interval is an ad hoc APL standard being used on New Horizons and Solar Probe Plus, as well as on RBSP, so that the same software algorithms can be used from mission to mission.

The RBSP avionics subsystem provides IMET or “spacecraft clock” to each of the science instruments. From the point of view of the instrument teams, however, the terms spacecraft clock and MET are interchangeable, even though the MET that the instruments “see” is really IMET. The VMET value is used on the ground by Mission Operations in the process of correlating onboard time to Earth time, but VMET is not seen or employed by any of the instrument teams. When VMET=0, the IMET value represents the time of the onboard time reference. In other words, IMET is a label for the time of the time reference, which can be correlated on the ground to Earth time. The onboard time reference for RBSP is the time of the trailing edge of a 1-Hz signal called the one-pulse-per-second signal (1 PPS).

The observatory onboard timing system is maintained through the distribution of a 1-PPS timing signal from the observatory avionics to observatory components and to instruments with a timing uncertainty within ±30 ms (3σ) to support the observatory-level timing accuracy requirements which define how well the time of a science observation (i.e., the instrument data time tag) or ancillary observatory data can be correlated to UTC after post-processing.

9.1 Time Accuracy Requirements

A primary need for science is to be able to correlate observations of an instrument on one observatory with observations of the same instrument on the other observatory and this is met by imposing requirements on each observatory to correlate the times of science observations to Earth time. These requirements are referred to as “absolute” time requirements and expressed as the allowed 3σ deviation from “true” UTC of the post-processing correlation between the spacecraft clock and UTC. In other words, the science observation time stamp that is based on the spacecraft clock is converted to an estimate of UTC, and that estimate must differ from true UTC by no more than the specified absolute time accuracy requirement. Table 12 lists the requirements on each of the science instruments. The RPS instrument is not listed because no absolute time requirement has been imposed on RPS.

Table 12 RBSP post-processing absolute time knowledge accuracy requirements

Relativity does affect the time accuracy but to a negligible extent (a few microseconds) for RBSP. The science observations are taken in the frame of reference of the observatory but UTC is defined in a frame of reference on the Earth. In addition to the requirements of Table 12, the relative timing between instruments on the same observatory is of interest. The post-processing 3σ error in the MET-based time stamps of each instrument relative to the EMFISIS flux gate magnetometer time stamp is specified. Table 13 lists these requirements.

Table 13 RBSP post-processing relative time knowledge accuracy requirements

Finally, the accuracy of the prediction of when each instrument command will be executed is specified as absolute accuracy of the time of execution of each command relative to UTC. The requirement is that command execution times shall be predictable 1 month in advance with an accuracy of ±5 s 3σ for all instrument and observatory time-tagged commands.

9.2 Implementation

Each observatory provides a 48-bit MET, latched at a known time in a transmitted frame that has an accuracy of ±70 ms 3σ relative to the 1 PPS and is placed in the frame secondary header. This accuracy includes uncertainties due to the frame pulse from the transceiver, the IEM hardware that latches the (downlink frame) MET, and the error contributed by software computation of some MET values. This supports the absolute mission-level measurement time knowledge accuracy that is needed to support the science measurements. The generation of MET and 1-PPS signals is undisturbed by processor resets. This helps to ensure that timekeeping requirements continue to be satisfied even if the IEM processor resets due to environmental or other effects.

The absolute time accuracy requirements are addressed by providing to the science teams and other users of time information two products (for each observatory) that relate the spacecraft clock to Earth time and that also provide other information relevant to that correlation. These products are generated routinely by Mission Operations and are called the Operations SCLK Kernel and the Time History File. The relative time knowledge requirements of Table 13 are addressed by limiting the time uncertainty contributed by each instrument itself to its MET-based time stamp. For example, the 5-ms EMFISIS/EFW relative time requirement is addressed by limiting the uncertainty contributed by each instrument to 1 ms which, together with a small allowance for the uncertainty in distribution of time from the C&DH to the instruments plus an allowance for margin, adds up to less than 5 ms.

The RBSP observatory is designed to achieve absolute time accuracy of ±50 ms for post-processing time accuracy to support the EMFISIS, EFW, and RBSPICE science instruments. This is satisfied with the use of a low-mass onboard clock oscillator. The evacuated miniature crystal oscillator (EMXO) used for this mission exhibits ±50 parts per billion (ppb) frequency–temperature stability over the full range of oscillator temperature.

An IEM off-pulse or power cycle results in the value in the MET counter being reset to zero. Once the cause of the problem is evaluated on the ground, the MET counter is restored to its original timeline by ground command. To aid in analysis of the problem and also to ensure that data generated after the off-pulse are not confused with data from earlier in the mission, the MET is set on the launch pad to a very large value. Specifically, MET is set to the number of seconds since 00:00:00 UTC on January 1, 2010.

Note that the same Operations SCLK Kernel is used before the off-pulse event and after the MET counter is restored to the original timeline. That SCLK Kernel cannot be used to examine data that occurred between those two events. The plan is to place post-off-pulse packets that contain low values of MET into a separate telemetry archive associated with that specific off-pulse event. Access to that data will require a manually generated Off-pulse SCLK Kernel unique to that off-pulse archive. It is expected that the off-pulse archive will not contain data from the science instruments.

As shown in Fig. 31, time from the observatory, together with information provided by the receiving ground station and with the predictive ephemeris provided by the navigation team, is used by Mission Operations to determine the correlation between the spacecraft clock and Earth time and to provide that and related information in the Operations SCLK Kernel and in the Time History File.

Fig. 31

Framework of the RBSP timekeeping system

9.3 The Operations SCLK Kernel

The RBSP ground system uses a set of navigation-related software developed by the Jet Propulsion Laboratory Navigation and Ancillary Information Facility (NAIF) called SPICE. SPICE provides tools for a variety of applications, including time conversions. Operation of SPICE depends on a collection of parameter files called kernels. One such kernel is the SCLK kernel, a text file containing a table that provides correlations between observatory time (IMET in our case) and Earth time. UTC is not used in SCLK kernels because of the discontinuities introduced by leap seconds. Instead, SPICE offers a choice between two continuous time systems. For RBSP, the continuous time system Terrestrial Dynamical Time (TDT or TT) is used; a TDT second is the same as a UTC second.

The particular flavor of SPICE SCLK kernel used for RBSP is called an Operations SCLK Kernel, with the following structure. Whenever the Operations SCLK Kernel is updated by Mission Operations to provide the most recent correlation between IMET and TDT, that correlation information is added to the end of the table in the kernel as a new time record. The new time record consists of three components: (1) an encoded SCLK that represents MET, (2) a corresponding TDT and (3) a predicted rate of change of the clock that we call “predicted TDTRATE,” the predicted rate of change of TDT for a unit change in MET. Another way of looking at TDTRATE is that it represents how long in TDT or UTC seconds a MET second lasts.

The predicted TDTRATE can be used by Mission Operations or by the instrument teams to determine the MET needed in a time-tagged command to cause that command to execute at specified future UTC. Mission Operations uses UTC exclusively for specifying command execution times. When another time record is added to the Operations SCLK Kernel, the TDTRATE of the previous kernel is recomputed to provide a more accurate estimate of the actual rate of change of TDT that has occurred for a unit change in MET, referred to as “interpolated TDTRATE.” To satisfy the post-processing absolute time requirements of Table 12, the interpolated TDTRATE should be used. In other words, when mapping the time stamp of a science observation to TDT, that mapping may not be sufficiently accurate if the predicted TDTRATE is used because that prediction does not fully account for the actual observed past behavior of the clock. The use of interpolated TDTRATE is what distinguishes the APL Operations SCLK Kernel from the standard SPICE SCLK kernel.

For each time record added to the Operations SCLK Kernel, a corresponding record (line) is added to the Time History File that contains information relevant to the SCLK Kernel time record and metrics related to that. For RBSP, those fields include

• Encoded SCLK

• The corresponding IMET

• TDT(G), the ground estimate of the TDT that corresponds to IMET

• The predicted TDTRATE, in TDT seconds per MET second

• The rate of drift of MET, in milliseconds per day

• A temperature related to EMXO temperature

• The method used to compute predicted TDTRATE

• The interval of data used to compute predicted TDTRATE

• The estimated error in the Operations SCLK Kernel correlation since the previous time record was added

• The average error in milliseconds per day since the previous time record was added

• The number of days since the previous time record was added

• The identification of the ground station that received the data used to update the Operations SCLK Kernel

• The computed one-way-light-time from the observatory to the receiving ground station

• The SCLK Kernel partition (should always be 1 for this mission)

• The presumed RF downlink encoding method (turbo or convolutional coding)

• The estimated downlink bit rate

• The observatory identification (A or B)

9.4 Concept of Operations

Maintenance of the Operations SCLK Kernel and of the Time History File is accomplished in the MOC by running custom timekeeping system ground software, called tk_automation, nominally once a day. Up to 4 days of downlink contacts can be missed without compromising the accuracy of the MET–UTC correlations provided by the Operations SCLK Kernel.

Data used for tk_automation will be taken only from downlinks received at the APL Satellite Communications Facility (SCF) and at the NASA Near Earth Network (NEN) USN ground stations in Hawaii and Dongara, Australia. All downlink data used for tk_automation will be turbo coded data at the operational downlink bit rates 125, 250, 500, 1000 and 2000 kilobits per second (kbps). In an extreme emergency, data at the emergency 1 kbps downlink rate can be used by tk_automation but with possibly reduced accuracy. Figure 32 illustrates the flow of data used by the MOC to support timekeeping.

Fig. 32

Mission Operations Center (MOC) external timekeeping interfaces

10 Guidance and Control

The RBSP guidance and control (G&C) subsystem is responsible for determining the attitude of each observatory and performing propulsive maneuvers to maintain each observatory in an attitude, spin rate, and orbit consistent with the mission’s objectives. The two RBSP observatories are major-axis spinners with no onboard software to estimate or control their attitude or orbits. Each observatory carries a blowdown monopropellant propulsion system with eight 0.9-N thrusters used to change attitude, spin rate, or orbit. These adjustment maneuvers will be designed and commanded from the ground. Onboard G&C flight software is limited to processing Sun sensor data and relaying this information to the instruments via a spin pulse or via the 1-Hz time and status message. Attitude prediction and determination are also performed using ground software tools.

10.1 Flight Sensors

The G&C sensors consist of a Sun sensor assembly and the Electric and EMFISIS fluxgate magnetometer. The Sun sensors, purchased from Adcole Corp., consist of two Sun sensor heads (SSH) spaced 180^∘ apart from each other about the spin axis, and a single Sun sensor electronics box (SSE). The SSH boresights are oriented such that the active fields of view do not overlap and cover an area roughly 2^∘ to approximately 85^∘ from the spin axis. Each head, when not in eclipse, will produce a Sun pulse, head ID, and Sun offset angle. The angular resolution of the Sun sensor assembly is 0.125^∘, and provides accurate Sun pulse and aspect angle data only when the observatory is spinning positively about its +Z axis. The assembly has been tested to operate between 3 to 15 rpm. The Sun sensor data are used by flight software to provide a spin pulse, observatory spin rate, phase angle, and Sun offset angle to onboard instruments and to autonomy when the observatory is not in eclipse. The data are also used in the timing for some of the open-loop propulsive maneuvers and are downlinked to the ground for attitude determination.

The EMFISIS fluxgate magnetometer data are also downlinked to ground for input to software that combines the magnetic field readings with Sun sensor data to produce an estimated observatory attitude. There are three different formats of fluxgate magnetometer data (compressed, uncompressed, and 1-Hz failsafe) from the EMFISIS instrument. There is also one pass-through format from the EFW instrument that can be downlinked in the event the digital section of the EMFISIS main electronics box fails.

10.2 Flight Actuators

Each type of propulsive maneuver will use a pair of the eight 0.9-N thrusters on the observatory. The length of the pulses for each maneuver will be chosen to minimize the amount of nutation and spin plane boom deflection during and after the maneuvers. The maneuvers will be used to maintain the spin axis to within 3.1^∘ 3σ and the spin rate to within ±0.25 rpm of their desired values. They will also adjust the orbit of the observatory as requested. The ΔV activities only use the pro-Sun and anti-Sun thrusters and are continuous, non-pulsed maneuvers. There is no plan to execute ΔV maneuvers in all inertial directions.

Thruster commands are decoded and executed directly by IEM hardware. The fault management system uses autonomy rules (executed in the IEM processor) to detect several unexpected conditions (such as a spin rate violation, maneuver in eclipse, and Sun angle violation) due to a maneuver error resulting from a command with incorrect timing, FPGA upset, or other causes. If one of these unexpected conditions is detected an autonomy rule will abort the maneuver so that mission operations can resolve the issue.

In addition, each observatory contains two ring nutation damper units, with the plane of the ring position normal to the X and Y axes of the spacecraft. These dampers are metal tubes fully filled with a silicon oil fluid and are located inside the spacecraft structure. They were designed at APL and are as large as feasible within the geometrical constraints of the observatory. They are intended to damp out the core spacecraft nutation oscillatory mode that is introduced after an observatory propulsive maneuver and after separation from the launch vehicle.

10.3 G&C Flight Software

For RBSP the traditional G&C functions are implemented as ground software tools and procedures. G&C flight software is limited to sampling Sun sensor data and providing spin pulses and spin period, rate, phase angle, and Sun offset angle information to the instruments and autonomy. The spin rate data are passed through a low-pass filter, and there are also several validity flags which indicate if the data are valid for use. The software also allows operators or autonomy to set eclipse flags, indicating if it is producing the spin pulse by receiving valid pulses from the Sun sensor assembly, or if the spin pulse is being driven by a hardware timer which used the last valid Sun pulse and derived spin rate to set the spin period.

Spin Pulse Accuracy

The requirement of the Sun sensor assembly is to provide a Sun pulse to an accuracy of within ±0.25/cos(α) degrees, where α is defined by the vendor as the Sun vector relative to the perpendicular to the spin axis. For this reason the pulse angle accuracy will change as a function of Sun offset angle. The actual accuracy varies from SSH-to-SSH. The timing accuracy of the pulse is then dependent not only on the Sun offset angle, but also any misalignments of the sensor heads, spin rate of the observatory, and timing delays between the SSH, SSE, and the IEM. Accuracy is not a function of altitude above the Earth. Table 14 presents an example of the variability in timing accuracy.

Table 14 Example Sun pulse timing accuracy assuming no misalignments, timing delays, and ±0.25/cos(α) degree Sun pulse accuracy per SSH. Actual performance will vary

The orbit defined for the RBSP mission will cause each observatory to periodically go into eclipse. During these times the spin pulse will be driven by a 20-μs-resolution hardware spin timer. When commanded, the flight software will initialize the hardware timer using a Sun pulse combined with the most recently computed spin rate. Because there is uncertainty in the spin rate, the accuracy of the hardware spin pulse timing will degrade as a function of time in eclipse mode.

10.4 Ground Software

The ground software tools include the Maneuver Design Suite, the Attitude Determination Software, and the Attitude Prediction Software. Each of these tools will be run either automatically or by G&C team members and the results will be provided to the mission operations or science teams. The Maneuver Design Suite software is a set of computer software components (CSCs) which (in conjunction with the high-fidelity simulator) take information on the desired maneuver target (change to spin axis direction, rate, or velocity), the current observatory state, selection of thrusters, and firing profile to produce commands needed to execute the maneuver. The Attitude Determination Software CSCs use the Sun sensor and EMFISIS fluxgate magnetometer data to generate estimates of observatory attitude. The Attitude Prediction Software CSCs will produce a nominally 42-day predicted attitude using the current observatory attitude, future maneuver schedules, and observatory configuration information. Both the attitude history and predicted attitude will be provided to the engineering and science teams in the form of SPICE C-kernel files.

Attitude Knowledge Uncertainty

The requirement of the attitude determination ground software is to ensure that the attitude knowledge uncertainty for each observatory coordinate frame relative to the inertial frame is ≤3^∘ 3σ per axis. This assumes that EMFISIS in-flight calibration activities have been conducted and that attitude knowledge is not guaranteed at times when magnetometer data are not available or for daily solutions during severe magnetic storms. When a storm does occur the quality of the solution will degrade as a direct effect of the measured magnetic field deviating from the reference magnetic field model. Methods were implemented in the software to use data before and after a storm to bound the attitude excursions, and possibly use a “snap shot” attitude solution at or very near perigee and then use Sun sensor spin pulse and spin rate information to propagate the attitude over the higher altitudes.

Ground Software-Generated Maneuvers

The Maneuver Design Suite software can generate three types of maneuvers: spin axis adjustments, spin rate adjustments, and orbit adjustments. For these different maneuvers the IEM is commanded via the ground with parameters that determine how the PDU will fire each thruster. The thruster control parameters indicate if the maneuver will use the Sun sensor pulses or the hardware timer, which Sun sensor head should be used, which thrusters should be used, and information that determines the on and off times of each thruster set. When the parameters are loaded and locked into the IEM a separate “start burn” command is sent to the IEM CCD to start the maneuver. Both ground software and autonomy do have the ability to terminate thruster firings using the normal thruster fire interface or via CCD command.

11 Propulsion

The RBSP propulsion subsystem is a blowdown monopropellant hydrazine system that provides precession capability, spin rate adjustments, and ΔV for each observatory (Bushman 2012). The system consists of eight 0.9-N (0.2 lbf) Aerojet MR-103G thrusters and components required to control the flow of propellant and monitor system health and performance. The propellant and pressurant are stored in the three identical tanks, without diaphragms, which are spaced equally around the observatory spin axes. The spinning of the observatory positions the propellant over the outlets at the spherical tanks’ midplanes. As propellant is expelled, the pressure of the pressurant decreases; therefore the thrust and specific impulse of the thrusters decrease as the mission progresses. All valves possess heaters to maintain temperatures above 5 ^∘C to protect the soft seals. The propulsion system schematic is shown in Fig. 33.

Fig. 33

Propulsion system schematic

The baseline usable propellant load for RBSP is 56 kg of hydrazine per observatory (see Table 15). For a launched wet mass of 665 kg, this translates to 183.4 m/s of ΔV. The propellant tanks are 25.6 liter (1560 in³) Inconel 718 tanks manufactured by ARDÉ. These 18.4 cm (7.25 in.) ID, vacuum-rated spherical tanks contain cruciform vortex suppressors, which aid in propellant expulsion at the outlet. The tanks have flight heritage on the THEMIS observatory. The maximum expected operating pressure and temperature for the RBSP mission is 400 psi at 50 ^∘C.

Table 15 Propellant budget

The thrusters on the RBSP observatory are of the catalytic monopropellant hydrazine type. When the dual-seat thruster valves are opened, propellant flows through the capillary tube into a catalyst bed, where the hydrazine spontaneously decomposes into hot gases, which then expand through a nozzle and exit the thruster, producing thrust. The MR-103G has substantial flight heritage including Iridium and Lockheed Martin A2100 spacecraft. The actual steady-state thrust produced on RBSP will vary from 0.97 N at beginning of life (BOL) to 0.25 N at end of life (EOL) as the tank pressure decreases. The specific impulse will range from 222.3 s at BOL to 205.7 s at EOL. The thrusters also possess redundant catalyst bed heaters. The remaining subsystem components—latch valve, filter, orifice, and pressure and temperature transducers—have substantial heritage. The propulsion diode boxes (PDBs), required to mitigate back-EMF (Electromotive Force) from valve closings, were designed by APL/Aerojet and built by Aerojet. They contain suppression and blocking diodes as well as test interfaces to support ground operations. The pressure transducer power conditioner (PTPC) slows the inrush current to the pressure transducers to ensure they operate properly during the RBSP mission.

12 Mechanical

The two observatories are nearly identical. In addition to differences such as spacecraft ID, RF operating spectrum allocations, and umbilical connections, the major difference is the accommodation of the separation systems. Observatory B has the hardware required for separation of the top Observatory A (from Observatory B) and the bottom Observatory B from the launch vehicle. All separation is controlled by the launch vehicle. Specifically Observatory B, at its forward end, houses the intra-spacecraft separation system for Observatory A and the pyros to initiate separation of Observatory A. At its aft end, it supports the top of the launch vehicle interface and the separation switches to indicate Observatory B separation from the launch vehicle. Observatory B also provides the telemetry interfaces to the launch vehicle for Observatory A separation from Observatory B.

The observatory mechanical design and configuration were selected to optimize for ease of access as well as to meet the launch vehicle loads and to fit both observatories stacked into a 4-m launch vehicle fairing. A single RBSP observatory with panels open is depicted in Fig. 34, which shows the placement of spacecraft electronics, instrument sensors, and instrument electronics boxes. The layout and packaging of these components provides the required fields of view for the instrument sensors and takes into account thermal needs as well as protection against radiation. The RBSP mission includes the first APL observatory to be completely tested at the APL environmental test facility, so care was taken to ensure each observatory would fit into the APL thermal vacuum chambers. The detailed observatory layout is shown in Figs. 35 and 36.

Fig. 34

RBSP observatory layout with side panels in a non-flight “open” orientation

Fig. 35

Observatory component layout (forward looking aft)

Fig. 36

Observatory component layout (aft looking forward)

The mechanical subsystem includes primary and secondary structure (central cylinder and structural panels), mechanisms, deployables, and a separation system. The primary structure is an aluminum-forged cylinder and the panels and decks are honeycomb with aluminum face sheet. The mechanical design incorporates the use of hinged panels to provide easy access for installation and integration of observatory components. The observatory is shown in stacked configuration in Fig. 37 in preparation for observatory vibration testing.

Fig. 37

RBSP observatory stacked in launch configuration for system test (Photo: Lee Hobson, JHU/APL)

Each observatory was designed to provide an offset of the maximum principal axis relative to the geometric +Z axis of less than 0.5^∘ (3σ, single axis) which provides a highly stable spinning platform. Nutation dampers are included to passively control nutation growth to maintain the offset of the observatory instantaneous angular velocity vector from the observatory +Z body axis at <0.5^∘ during the operational phase of the mission. Observatory mass properties and spin balance testing were performed as part of the test program to verify that there will be less than 1^∘ error of spin axis relative to the observatory frame. The observatory test configuration for spin balance and moment of inertia (MOI) testing to validate mass properties is shown in Fig. 38.

Fig. 38

Observatory spin balance and moment of inertia (MOI) testing were performed to validate mass properties (Photo: Ed Whitman, JHU/APL)

The RBSP external surfaces are conductive or static dissipative to maintain ground continuity throughout the structure and to preclude surface charging. This was done to reduce the effect of the observatory on the electric field and particle science measurements. External surfaces are painted with a black conductive paint and the outermost blanket layer incorporates a conductive Kapton material. Thermal radiators for RBSP are constructed of Germanium Black Kapton based on material testing performed to measure radiation tolerance.

Each observatory is equipped with four deployable hinged solar arrays and two deployable hinged instrument booms. Two EMFISIS sensors [a magnetic search coil (MSC) and a fluxgate magnetometer (MAG)], are mounted to the tip of the −Y boom and the +Y boom, respectively. Solar array panel and EMFISIS boom deployment testing was conducted to verify the performance of the APL-designed hinge and release mechanisms. The first set of tests was performed on the G-negation stand; the second set was performed on the observatory after its environmental tests. A final test was performed just prior to launch. All test subjects were in the final flight configuration for this set of tests, including the thermal blankets, the harnesses, and the EMFISIS magnetic sensors. Figure 39 shows one of the initial in-air deployment tests that was conducted with a solar array wing and its magnetometer boom.

Fig. 39

In-air deployment test of solar array wing (Photo: Ed Whitman, JHU/APL)

13 Thermal Management

The two RBSP observatories utilize a cold-biased passive thermal control design system to maintain the onboard electronics and instruments within their required temperature limits. The majority of the electronics boxes are hard-mounted to the inside of the spacecraft panels and decks, with their internal heat going into the main structure. Local radiators on the side panels and bottom deck control the amount of heat lost to the space. Multi-layer insulation blankets cover the majority of the outside of the observatory, especially on the top deck to provide insulation from the Sun as RBSP is a near Sun-pointed spinning observatory. Heater circuits on all the panels and decks are installed to protect the observatory from getting too cold. Very little heater power is expected to be needed on orbit, and the heater circuits are provided as a fail-safe device. A few observatory components, such as the lithium-ion battery and several instruments, are thermally isolated and have their own radiators, blankets, and heaters. Table 16 shows the test temperature limits for all the major components on the observatory. The observatory will be maintained on orbit inside of the test limits specified for the typical electronics boxes of +55 and −25 ^∘C.

Table 16 Observatory component test temperature limits

The observatory thermal design was validated by the thermal balance test and by thermal vacuum hot and cold cycle testing performed at APL from February 14, 2012, to April 3, 2012. The test configuration is shown in Fig. 40 with the two RBSP observatories side by side in their respective thermal vacuum chambers in the Space Simulation Laboratory (SSL) at APL. All temperature and heater margins were found to be acceptable based on the results of the thermal vacuum testing. The predicted instrument survival temperatures are shown in Tables 17 and 18 for Observatory A and Observatory B based on the results of this system-level thermal testing. All highlighted areas were evaluated and determined to have acceptable margins as they are either protected by heaters or actively controlled by heaters.

Fig. 40

RBSP Observatories A and B side by side prepared to lift into thermal vacuum chambers at JHU/APL (Photo: Ed Whitman, JHU/APL)

Table 17 Observatory A instrument survival temperatures

Table 18 Observatory B instrument survival temperatures

14 Integration and Test

The RBSP observatories were built and tested at APL. The observatory-level testing ensured that these two spacecraft and their payloads would withstand the launch and also operate successfully throughout their on-orbit environment. Significant spacecraft and observatory testing was conducted at APL and included the typical suite of environmental testing including vibration, shock, and thermal vacuum testing (Kirby and Stratton 2013).

The two RBSP observatories are shown proceeding through the integration and test phase of development in Fig. 41, side by side in one of the spacecraft integration and test high bays at APL. After the completion of environmental testing, the observatories were shipped to Astrotech, located nearby the Kennedy Space Center, for final integration and test and integration with the launch vehicle. The stacked observatories were successfully launched from Cape Canaveral Air Force Station on an Atlas V 401 launch vehicle on August 30, 2012.

Fig. 41

Two RBSP observatories in cleanroom at JHU/APL (Photo: Lee Hobson, JHU/APL)

14.1 Environmental Testing

Dynamics testing was performed in the APL Vibration Test Laboratory (VTL). The first test performed in this sequence was direct-field acoustic testing. In this test the stacked spacecraft were subjected to a simulated launch acoustic environment created by stacks of speakers that surrounded the spacecraft. The field was controlled to a specified profile through the use of control microphones set up in the sound field, and the response of the spacecraft was measured by accelerometers (Maahs 2012). Next, the RBSP spacecraft stack was exposed to a three-axis sine vibration test at protoflight levels to verify that the spacecraft stack fundamental frequencies meet the interface agreed to with the launch vehicle. The test also verified that the spacecraft assemblies demonstrate proper workmanship as integrated for flight. The tests were conducted without any issues. The spacecraft stack fundamental frequencies were shown to be 14.6, 14.4, and 30.2 Hz in the X, Y, and Z axes, respectively which are all above the minimum launch vehicle defined interface requirements.

Shock testing was performed on each spacecraft to verify that the shock induced by the launch vehicle separation would not cause any damage to the spacecraft or spacecraft components. The launch vehicle-provided payload separation ring was used initiate the shock event at the bottom of the spacecraft stack. The spacecraft-provided inter-separation system between the Observatory A and Observatory B spacecraft was used to initiate the shock event for the top spacecraft. Both spacecraft passed the shock testing and the responses (as measured by onboard accelerometers) matched the predictions of the spacecraft dynamic analysis.

Initial spin balance testing was conducted on each spacecraft bus at rates up to 70 rpm. This testing provides data that is used to verify the spacecraft mass properties and balance mass placement on each spacecraft that are needed to meet the stability requirements on orbit. The nominal spacecraft spin rate on orbit is 5.5 rpm; however, the spacecraft was to be exposed to higher rates up to 15 rpm as part of the deployment of the spin plane booms. The solar arrays and magnetometer booms underwent spin balance testing to verify that they were properly balanced for flight. Deployment testing was performed on each solar array panel and on each of the magnetometer booms. All of this testing was performed at the APL Integration and Test facility.

The Environmental Test Facility at APL has side-by-side vacuum chambers that were used to test the two RBSP observatories in parallel as shown previously in Fig. 40. All instruments were integrated onto the spacecraft for this 6-week long test at APL. Initially a thermal balance test was conducted to demonstrate the thermal performance of the spacecraft at four thermal balance cases. This was followed by four thermal cycles including transitions from hot to cold cycling the temperature between −15 and +45 ^∘C. The thermal cycle testing demonstrated that the RBSP spacecraft, assemblies, and instruments performed as expected over the operating temperature range that they will be exposed to in flight with margin. The RBSP integration and test team performed an observatory level comprehensive performance test (CPT) verifying that all spacecraft subsystems and the seven unique instruments operated successfully at hot and cold temperature extremes. Mission simulation testing was conducted during environmental testing by the mission operations team, exercising the command and control interfaces between the spacecraft and the ground systems. Finally ground station compatibility testing between the spacecraft and the APL SCF ground station, the USN ground stations, and the TDRSS network was performed over temperature to test all communication paths between the spacecraft and the ground system that will be used once the observatories are on orbit.

14.2 Processing at Astrotech

After the successful completion of the environmental testing at APL, the RBSP observatories were transported to Titusville, Florida, where final assembly, test, and propellant loading were completed at the Astrotech Facility. A final spin balance test was completed for each spacecraft to ensure that the final mass properties of each spacecraft were accurately modeled. A spacecraft-level magnetic swing test was conducted which verified that the residual magnetic field of the spacecraft was well understood. This is important so that instrument science measurements will not be adversely affected during the mission by spacecraft-generated magnetic fields contaminating the measured fields in space.

The RBSP solar array wings consist of solar array panels as well as instrument magnetometer booms. These were assembled in Florida at Astrotech and then all were installed on their respective spacecraft. Solar array flood testing was conducted to verify that all solar array cells were working properly and magnetic phasing testing was conducted to verify the magnetic cleanliness of the solar arrays in their final configuration. The RBSP mission includes two spacecraft and each has four solar array panels and two magnetometer booms, which made this an extensive effort. Deployment testing was completed on all deployables before they were stowed for launch.

Propellant loading is one of the final steps in preparing the spacecraft for launch. The RBSP spacecraft each carry 56 kg of hydrazine propellant onboard for use in orbit trimming maneuvers and spacecraft attitude adjustment during the life of the mission. Hydrazine is a hypergolic fuel and therefore propellant loading is a hazardous operation and is performed by trained personnel in Self-Contained Atmospheric Protection Ensemble (SCAPE) suits. The RBSP spacecraft underwent this final fueling procedure at Astrotech a few weeks before launch.

The payload launch adapter and launch vehicle fairing were mated with the stacked RBSP spacecraft at the Astrotech facility in preparation for integration onto the launch vehicle. The electrical interfaces were connected so that the launch vehicle would be able to send the signals needed to release the spacecraft once on orbit. Final inspections and closeout were completed and the spacecraft stack was completely encapsulated in the launch vehicle payload fairing. A transporter vehicle was used then used to move the encapsulated fairing out to the Atlas V processing facility where the launch vehicle was being assembled.

14.3 Atlas V Processing

Once at the Atlas V Vehicle Integration Facility (VIF) located on Cape Canaveral Air Force Station, the RBSP launch vehicle and the spacecraft underwent final preparations for launch. The spacecraft flight batteries were charged for launch. The clampbands that would be used to release the spacecraft from the launch vehicle were tensioned and checked. All safe plugs were replaced with arming plugs. In Fig. 42 the Atlas V 401 with the RBSP observatories onboard is shown at the launch pad, ready for launch.

Fig. 42

RBSP onboard the Atlas V 401 launch vehicle ready for launch (Photo: Ed Whitman, JHU/APL)

15 Conclusion

The Radiation Belt Storm Probe (RBSP) mission includes two observatories designed and built at the Johns Hopkins University Applied Physics Laboratory (APL), for NASA’s Living with a Star heliophysics program. The purpose of the RBSP mission is to collect data about the Earth’s Van Allen radiation belts and the response of these belts to solar activity. The twin RBSP spacecraft and the payload they house are hardened to survive and operate in the harsh radiation belt environment for the initial 2-year mission life. It will take 2 years for both observatories to explore all regions of both the inner and the outer Van Allen belts. By using two observatories that will fly through different parts of the radiation belts at the same time, the data returned from the instruments can be combined to provide information about how the environment changes in both space and time. So far these two Van Allen Probes are meeting all expectations for working well beyond the initial 2 years. The observatories each have consumables onboard to continue to return valuable science data for over 5 years while in orbit and traversing through the Earth’s radiation belts.