First-Hand:Lessons Learned from Six Decades of Spacecraft Guidance and Control Experiences

Submitted by Henry C. Hoffman, Jr., ATK Space, Beltsville, Maryland, 20705

This paper documents the results of a National Aeronautics and Space Administration (NASA) Engineering and Safety Center (NESC) Guidance, Navigation and Control (GN&C) Knowledge Capture activity that grew out of the June 2006 NESC Academy course on Satellite Attitude Control Systems (ACS) held at the University of Maryland / College Park and the December 2006 System Engineering Seminar held at the NASA / Goddard Space Flight Center (GSFC). This paper provides a description and discussion of the key lessons learned from Mr. Hoffman’s six-decade long career in the field of spacecraft GN&C engineering. Several fundamental Lessons Learned derived from multiple real-world spacecraft examples will be summarized in this paper in a manner to provide both expert knowledge and in-depth technical insight for future generations of spacecraft GN&C engineers. These examples will primarily be drawn from Mr. Hoffman’s service as the head of the NASA/GSFC Guidance and Control Branch over the period 1962–1993, and consulting over the period 1993–2007. Specific spacecraft GN&C examples discussed will include Explorer-1, OGO-4, OAO-2, IUE, SMM, TDRS, COBE, Ulysses, GOES, and SOHO.

Introduction

The National Aeronautics and Space Administration (NASA) Engineering and Safety Center (NESC) in June 2006 presented me with an opportunity to share some of my experiences in the Guidance Navigation and Control (GN&C) of missiles and spacecraft. These experiences, derived since the 1940s, formed a core of lessons learned that have recurred in different forms on various programs before and since my tenure as the Branch Head for GN&C at the Goddard Space Flight Center (GSFC). The stated objectives for the purposes of the NESC Academy Presentation were:

• Discuss key design and development issues associated with guidance and control systems
• Discuss troubleshooting techniques to resolve guidance and control anomalies
• Discuss on-orbit satellite Attitude Control Systems (ACS) troubleshooting techniques and processes
• Discuss on-orbit satellite ACS recovery techniques and processes
• Present some of the GN&C history for each of the six decades.

1940s

World War II RADAR

In the 1940s, radar (use of the word RADAR started in the early ‘40s as an acronym for RAdio Detection And Ranging) was just coming into its own, driven by World War II. On Sunday, December 7, 1941, the early SCR270 RADAR (Fig. 1) picked up the Japanese planes about an hour before they reached Honolulu but the operator’s superior officer discounted the radar blips as “probably some of our aircraft from the mainland”. This proved to be a fatal mistake. Later, during WWII, radars were used to target range and direction and to direct gunfire.

WWII radar was highly classified and in order to reduce the security level a letter code was used for the frequency bands (i.e. K, C, X, etc.). The code was deliberately designed to confuse. After the war when the commercial microwave field blossomed all the engineers in that field had cut their teeth on WWII radar and the code was a second language. It is still used today and still confuses.

The ‘40s also brought forth the development of the Variable Time (VT) fuse (Fig. 2) (as opposed to fixed time mechanical fuse). The VT fuse was somewhat like radar in that it operated on target reflected radio signal to detonate the shell. The vacuum tubes in the VT fuse had to withstand launch shocks of as much as 10,000 g’s when fired from a gun. The VT fuse was developed by the Johns Hopkins Applied Physics Lab (APL).

Werner von Braun

Early supersonic wind tunnels were developed at Peenemünde, Germany, under the direction of Dr. Werner von Braun in the ‘40s and were used in the development of the V1 and V2 missiles that rained down on London. After the war, these tunnels, along with some of Dr. von Braun’s scientists (Dr. Richard Lehnert and others), were exported to the Naval Ordnance Lab (NOL) at White Oak, Maryland just outside the Washington, D.C. beltway.

The Peenemünde Tunnels continued to evolve at NOL. When NOL was closed in 1997 the only thing retained was Wind Tunnel #9, a Mach 17 tunnel. Tunnel #9 has long test times of up to 15 seconds, compared to other hypervelocity tunnels, which have test times of only a few milliseconds. It is currently used by the Air Force, Navy, Army, NASA, and the Missile Defense Agency. Tunnel #9 is now operated at White Oak, Maryland by Arnold Engineering and Development Center (AEDC) of Arnold Air Force Base, Tennessee.

1950s

Angled Arrow Projectile / Gun Launched Guided Missile

In the 1950s, the Peenemünde (then NOL) tunnels were used in the development of the Angled Arrow Projectile / Gun Launched Guided Missile (AAP / GLGM) (Fig. 3). This was a 4" sub caliber fin stabilized shell fired from an 8″ smooth bore naval gun at about Mach 4. A one shot in-flight mid course trajectory correction of ~6 degrees in any direction could be accomplished through radio command by the firing of a small rocket out the side of the missile. This crude anti-aircraft guided missile never went operational.

SUBROC and It’s Developmental Testing

The SUBROC (SUBmarine ROCket) missile (Fig. 4) had a full blown analog inertial guidance control and navigation system with 3-axis attitude and 3-axis inertial velocity and position. It had a nuclear warhead.

The NOL wind tunnels were used to develop the missile. SUBROC was a nuclear tipped anti-sub missile launched from a standard torpedo tube from a submerged submarine. SUBROC went operational in the ‘60s but was never fired in anger. It should be noted that since SUBROC was nuclear it had many safety features and, as always, each safety feature cut into the reliability. The safing and arming engineers insisted on an anti-circular run (ACR) gyro, as was used in torpedoes, to dud the warhead if a damaged torpedo should run in a circle and hit the launching submarine. They wanted to use a $5,000 ACR gyro to check on the quarter of a million dollar inertial platform that had its own internal checks, which could dud the warhead if the missile went off course. I did not want an ACR gyro because it would only add slightly to the post-launch safety but would have a significant impact on reliability. I had no argument about pre-launch safety but I argued against some post-launch safety because of the reduced reliability. It was as if you and I are confronting each other with loaded shotguns. I am much more concerned about the reliability of my gun than I am about its safety. I lost that argument.

Since SUBROC had many phases (underwater launch, water-air transition, sub- and supersonic flight, supersonic reentry, underwater trajectories, and detonation) the design development and testing had to cover all phases (see Fig. 5 and Fig. 6). There was a concern about the water-air transition. Surplus rocket motors with about a three second burn time were mocked up to the proposed SUBROC configuration and launched from the Patuxent River at Solomons Island, Maryland. The three second burn made it impossible to land one on the White House lawn. The waterair interface proved no problem. In fact, it was hard to detect so that the control gains could be changed from water to air settings. To the best of my knowledge, this was the first time a solid rocket was flown under control, under water.

The second phase of testing was done at Naval Ordnance Test Station (NOTS), China Lake, California. These were launched from a rail launcher in the Mojave Desert. One test of interest went out of control about halfway through the powered flight. Dr. Richard Lehnert, who came from Peenemünde with his supersonic wind tunnels was responsible for the aerodynamics. I was responsible for the Guidance and Control. After the flight we had some disagreement, but after we defined our terms all disagreement was resolved down to the second as to what happened where, when, and how. The one basic difference was that I was reading telemetry strip charts and Richard stood a safe distance behind the launcher and counted. He didn’t even have a stop watch. When I commented on this he told me that the best places to view a launch was either from behind the launcher or from the impact site. That was what they did for the V1 and V2 developments at Peenemünde. During the early testing he said that the impact site was the safest place to be.

There was a rivalry between the mechanical designers and the GN&C engineers. The mechanical designers assumed that any failure had to be electrical and not mechanical. The third phase of testing was underwater launches off San Clemente Island, California. The missile was planted on the bottom in a torpedo tube under a LST (Landing Ship, Tank) and launched toward the island so that the on-board magnetic tape recorder could be recovered to provide the underwater telemetry. So far we had always managed to squeeze some sort of success out of each launch. The first underwater launch came out of the water in three pieces, went back over the LST, and started a fire on the deck. The mechanical engineers figured that they finally had their chance to nail GN&C. Since we were the only ones with an understanding of the control dynamics it became my responsibility to brief NOL upper management of the “failure”. I stepped up to the podium and stated that “for openers I want to declare the latest launch an unqualified success from a GN&C perspective”. The navy divers had aimed the torpedo tube at an underwater rise. The dynamics is such that the missile first sinks and develops upward angle of attack. Being hydrodynamically unstable the first and only commands given to the control system underwater are to dive. If left uncontrolled this unstable pitch would have caused SUBROC to continue to pitch up. The pitch controls hold it back with a dive command so as to maintain pitch control. The upper management of NOTS, who were responsible for the San Clemente range, got a hold of the on-board tape recordings and accused my junior engineer (John Kelly) of wiring up the controls backward causing the dive command, which flew the missile into the bottom.

The whole purpose of the San Clemente series was to characterize the underwater hydrodynamic coefficients. The balance of the launches defined our coefficients underwater but lost control after exit. We determined that one of the pitch controls jammed and could not be retraced after the dive command but the mechanical people insisted the fault could not be mechanical and had to be electrical. They launched the whole series with this failure. The controls were four jetavators, which are molybdenum cups over four nozzles that dip into the jet stream for control. Sea water cooled one of the pitch jetavators causing a solid aluminum oxide buildup and jamming the control. A simple splash deflector corrected the problem (mechanical, not electrical).

As part of the SUBROC safety, a monitor wire goes through many of the rocket, missile, and warhead components. If this wire was broken for any reason the rocket ignitor was motor driven to a safe condition preventing rocket ignition. The final series of tests before SUBROC went operational were underwater launched from the Permit submarine. The rocket ignition was delayed by about one second after torpedo tube launch to allow the missile to attain a safe distance from the submarine. Launch broke the monitor wire and the one second delay allowed the ignitor time to be driven to a safe position. The ignitor fired into a steel plate and the very first submarine launch went straight to the bottom. This fault was designed into the system from the very beginning. None of the reviews or many engineers and reviewers (four contractors in addition to NOL and NOTS) turned up the fault. SUBROC went operational in the early 1960s and was decommissioned in the late 1980s.

Explorer-I Satellite

Explorer-I was the very first American satellite launched on a modified Jupiter-C rocket by the Army Ballistic Missile Agency (ABMA), under the direction of Dr. Werner von Braun, on January 31, 1958. Developed by a team from the Jet Propulsion Laboratory (JPL), the Explorer-I satellite was orbited in less than 90 days after launch approval. This approval came very shortly after the Russian success with Sputnik. In fact, the Explorer-I spacecraft was ready for launch before Sputnik but it was not allowed to launch for political reasons.

Explorer-I was a spin-stabilized vehicle with a mass of 14 kg. It was placed into an elliptical Earth orbit with an inclination of 33.2˚, and having a perigee of 347 km and an apogee of 1,859 km. Explorer-I carried the U.S.-IGY (International Geophysical Year) payload of James Van Allen, University of Iowa. Explorer-I was given credit for the discovery of radiation belts around the Earth.

Explorer-I encountered stability issues at the very beginning of its mission. The origin of these stability issues can best be understood by considering fundamental physics, in particular by considering the fundamental principle of Conservation of Angular Momentum. Explorer-I was designed to be spin-stabilized about its minimum moment-of-inertia axis (I_min). From basic physics we know the rotation of rigid body about either its maximum or its minimum inertia axis can be stable. The Explorer-I stability problem stemmed from the assumption that the spacecraft was a rigid body. In fact, Explorer-I was not really a rigid body and energy dissipation in the flexible whip telemetry antennas (see Fig. 7) had a destabilizing effect that resulted in flat spin about its maximum moment of inertia axis (I_MAX). This occurred within a few orbits after launch of the spacecraft. As the outcome of the Explorer-1’s mission success was more bent on actually achieving orbit and receiving a telemetry return, the flat-spin did not become a show-stopper.

The simple and fundamental fact that the Conservation of Momentum must hold can be considered as the “holy grail” of momentum stabilized spacecraft dynamics. As a case in point, a few simple equations derived from a Conservation of Momentum starting point reveals the Explorer-I stability issue.

Momentum:

• H=Iω=K (constant)

Energy:

• E=½ Iω2
• E_min=½ (I_MAXω_min)ω_min =½ Kω_min
• E_MAX=½ (I_minω_MAX)ω_MAX =½ Kω_MAX

Where:

• H = momentum
• E = energy
• ω = spacecraft angular velocity
• I = momentum of inertia

If there is a mechanical energy source (nutation damper) onboard, the energy could be pumped up resulting in a stable spin about the I_min axis. E_MAX would equal ½ Kω_MAX. For Explorer-I, this would mean stable spin about the minimum inertia axis (I_min) as intended. But there was no mechanical energy source (nutation damper) onboard; only an energy sink in the energy dissipation in the flexible telemetry antennas. This resulted in a minimum energy state where E_min=½ Kω_min and a flat spin about the maximum inertia axis (I_MAX). This occurred in a few orbits.

Since the total angular momentum must be conserved in the inertial frame of reference (not the body frame) it can be used as a sanity check on computer simulations. A computation of total system angular momentum with all external disturbances (i.e. aerodynamic, gravity gradient, solar pressure, magnetic, etc.) turned off in the simulation should remain constant. If this is not the case, there is an error in the simulation. This error must be corrected if one is to believe the simulation.

1960s – Dawn of Satellite Era

Orbiting Geophysical Observatories

A series of six (6) Orbiting Geophysical Observatories (OGOs) were put into orbit by NASA between 1964 and 1969. The purpose of the six Orbiting Geophysical Observatories was to conduct diversified geophysical experiments to obtain a better understanding of the Earth as a planet and to develop and operate a standardized observatory-type satellite. Specifically, the OGO satellites were intended to study the Earth's atmosphere, magnetosphere, and the space between the Earth and Moon.

The OGO satellites all had the same general construction and were all in the 500 kg mass class. Each vehicle consisted of a main body, generally parallelepipedal in form; two rectangular solar panels each including a Solar-Oriented Experiment Package (SOEP), two Orbital Plane Experiment Packages (OPEP), and six appendages (EP-1 through EP-6) supporting the boom experiment packages. Up to seven experiments could be mounted on the SOEP and on the OPEP. The main body (pitch and roll) was attitude controlled by use of infrared Earth horizon scanners and reaction wheels, and was designed to point the Z-axis (yaw) toward the Earth. The axis connecting the two solar panels (X-axis; pitch) was designed to remain perpendicular to the Sun line. The solar panels, activated by sun sensors, could rotate about this X-axis to obtain maximum solar energy flux on the solar cells and, concurrently, orient the SOEP properly. The OPEPs were mounted on either end of an axis, which was parallel to the Z-axis and attached to the forward end of the main body. The OPEP sensors normally were maintained looking forward in the orbital plane along the velocity vector. To maintain this orientation, the OPEP axis could rotate over 90 degrees, and, in addition, an angular difference of over 90 degrees was possible between the orientation of the upper and lower OPEP packages.

OGO-1, with a mass of 487 kg, was successfully launched from Cape Kennedy on 5 September 1964 and placed into an initial orbit of 281 x 149,385 km at 31 degrees inclination. The OGO-1 satellite was a partial failure because two experiment booms failed to properly deploy, with one of the booms obscuring an infrared (IR) horizon scanner's view of earth. The IR earth horizon sensor locked onto the boom and caused the spacecraft to spin up about the maximum inertia axis similar to Explorer-I. Some of the science was achieved because the maximum inertia axis was a stable spin axis and could be maneuvered by ground commanded thrusters to keep the solar arrays on the Sun line. Since the spacecraft attitude could not be nominally maintained with respect to the Earth, as desired, the OGO-1 spacecraft was placed into a permanent spin stabilized mode of 5 rpm about the Z-axis. Nevertheless, data from all 20 experiments onboard was received, although at a "less than expected capacity" from some of them. During September 1964, acceptable data were received over 70% of the orbital path. Spacecraft operation was restricted to Spring and Fall due to power supply limitations. OGO-1 was completely terminated on 1 November 1971.

OGO-4, with a mass of 562 kg, was launched on 28 July 1967 (see Fig. 8). OGO-4 had a 60-ft. long experiment antenna boom deployed out of the tip the solar array. The boom was similar to a carpenter’s steel tape ruler. The steel tape has a preset curve of approximately 30°, which is flattened so the tape can be rolled into a small container. The OGO tape boom had a preset curve of 450° so its preset shape was a cylinder with a 90° overlap. This configuration has very low torsional stiffness. Soon after the 60-ft. boom was deployed the spacecraft developed instability with the spacecraft rocking and the boom oscillating with a tip deflection of 20 feet. One of my young new hires (Harry Frisch) came to me with the theory that the problem was thermal. I could not conceive of any way that this was possible. So my best approach at that time was to deny that this was possible. This I did successfully for two weeks until the spacecraft went into eclipse, at which time the oscillations stopped. Soon after coming out of eclipse they started again. At this point it was hard to deny that maybe it was a thermal problem. I had lost my security blanket.

The sun driven thermal bending and torsion of the boom caused spacecraft attitude oscillation resulting in thruster firings. The 60-ft. boom had a tip deflection of ±20 feet. This was the first in-orbit demonstration of direct conversion of solar energy into mechanical energy. The thrusters had to be disabled to prevent the loss of all the control gas. The spacecraft was flown on reaction wheels. However, the reaction wheels would saturate over time and the gas would have to be momentarily enabled to de-saturate the wheels. ACS controllers were sent to several tracking stations around the world to perform this function in real-time.

Orbiting Astronomical Observatory

The second class of Goddard Space Flight Center observatory satellites were the Orbiting Astronomical Observatory (OAO) spacecraft. OAO-1 carried a science payload to make precision astronomical observations and to measure the absorption and emission characteristics of the stars, planets, nebulae, and the interplanetary and interstellar media from visible to gamma-ray regions. The OAO science goals dictated stringent ACS requirements for pointing accuracy and pointing stability. The ACS for OAO-1 was a “gyroless” zero-momentum design because of the lack of confidence in gyro reliability (lifetime) for a multi-year mission. The OAO-1 ACS had a total of six (6) 2-axis gimbaled star trackers. The six star trackers were programmed by the onboard memory to acquire and track appropriate guide stars. Error signals were generated that drove the reaction wheels to obtain stellar stabilization. The ACS design included coarse momentum wheels which were used for slewing the spacecraft through large angle maneuvers. The spacecraft’s control system provided three axes of control with a pointing accuracy of 1 arc minute after the star trackers acquired guide stars. The control system permitted an ultimate pointing accuracy of 0.1 arc second.

The OAO-1 spacecraft, built in an octahedron shape aluminum structure, was 3m by 2m in size and had a mass of approximately 1,800 kg. The spacecraft had a 1.2 m hollow central tubular area, which housed the space science experiments. Solar panels were mounted on each side of the spacecraft at angles of 34 degrees and had an area of 38.2 square m. A sun baffle protected the experiments and increased the length of the spacecraft to 4.9 m. Two inertial balance booms, one forward and one aft, extended approximately 6.8 m for the core body of the spacecraft.

OAO-1 was launched on April 8, 1966 into a nominal circular orbit and operated as planned for the first seven minutes after separation. Subsequent high voltage arcing of all six star trackers (a common mode failure) and battery depletion caused the OAO-1 mission to be terminated as a failure after 20 orbits without activating any of its science experiments.

Following the demise of the OAO-1 mission the Goddard Space Flight Center was ordered by NASA Headquarters to go and talk to the MIT Instrumentation Laboratory. Dr. Charles Stark Draper, who ran the MIT Instrumentation Laboratory and who was the “granddaddy” of inertial navigation, promised to build gyros for us to provide an inertial attitude reference for the spacecraft's attitude control system with a drift rate performance metric of 1 arc-sec per year. The Inertial Reference Unit (IRU) from MIT to be flown on the OAO-2 observatory used three single degree-of-freedom, floated, rate-integrating gyros operated in binary, pulse-restrained torque loops. We were initially told by MIT that we could turn on the gyros on the launch pad and not have to update them for months. On our second visit to MIT the 1 arc-sec per year performance claim from MIT had became 1 arcsec per month. On later visits it became 1 arc-sec per week, then 1 arc-sec per day, and finally 1 arc-sec per orbit. The 1 arc-sec drift value remained the same but the units of time were consistently reduced over the course of their gyro development by MIT.

The OAO-2 observatory, with a mass of 2,150 kg, was launched into low Earth orbit on December 7, 1968 (see Fig. 9). OAO-2 carried 11 UV telescopes, and operated successfully for many years. In fact OAO-2 detected a supernova in May 1972, as well as the first UV radiation from the center of the Andromeda Galaxy M31. The IRU gyros provided by MIT performed well. Analysts at GSFC observed that promised gyro drift rate performance of approximately 1 arc-sec per orbit was achieved on OAO-2. According to a MIT report published in 1974, when the effects of known disturbances on the OAO spacecraft were considered, the standard deviation of gyro drift rate appeared to approach 1 arc-sec per hour indicating better than predicted performance.

1970s

Small Scientific Satellite

The Small Scientific Satellite (S³ or Explorer-45) was one of the first satellites of this decade. Launched on November 15, 1971, its mission was to study the earth’s magnetosphere (see Fig. 10). It was a small, spin-stabilized satellite, with a launch mass of approximately 52 kg, and was placed in a highly elliptical orbit of 272 km x 18,149 km at 3.2° inclination. It was one of the few satellites that were launched from the Italian San Marco launch platform with an American Scout B launch vehicle. The launch platform was a refurbished WWII floating dock which was fixed to the bottom of the Indian Ocean off the coast of Kenya in international waters. This launch platform has never had a launch failure.

One of the magnetic experiments required radial booms to isolate it from the spacecraft’s local magnetic field. These booms were designed very stiff when contrasted with the tape booms of the OGO-4 or the wire deployed booms of the recently launched THEMIS spacecraft. Soon after attaining orbit and deploying these booms, I received a call that S³ was having nutation problems. It was finally determined that the boom bending being a function of Sun angle had a small component at nutation frequency because the Sun angle had a component at nutation frequency. This was the culprit.

The sun was providing a source of energy that contributed to S³’s nutation instability. To consider the problem, one can think of two extremes of the material properties of the booms with respect to their thermal time constant. This is the time required to achieve a maximum deflection of the boom when lit, or alternately when it returns to its ‘cold’, unlit state. In the first case, consider a thermal time constant of zero. If bending were to occur, it would not add energy to the system because it would be in phase with the motion relative to the Sun. The other logical extreme is an ‘infinite’ time constant. In this case, there would be a deflection of the boom, but it would be a one time event, and again would not contribute to nutation. For all other time constants there would be bending and phase shift components at spin and nutation frequency. The nutation can be thought of as structural resonance of a spinning body. Bending at nutation frequency means mass motion at nutation, which will tend to drive or damp nutation. In the case of S³ it drove nutation. If the spin axis is near the sun line you have maximum bending but zero components at nutation frequency. This case was borne out when S³’s spin axis was moved closer to the sun line, with near full sunlight on each boom. With the sun nearly normal to the boom, small angular variation at nutation frequency did not result in any significant component of thermal bending at nutation frequency. The nutation disappeared.

If the time constant is such that there is some mass motion and phase shift at nutation frequency, there will be impact on nutation. This phenomenon is not limited to booms. Any mass motion at nutation frequency that has the potential to move on a spacecraft at nutation frequency can affect nutation. This effect could ultimately be either stabilizing or destabilizing. Later, I’ll discuss how this played out in the ‘Santa Claus Prediction’, on the Ulysses spacecraft in the decade of the Eighties (see VI, D).

Radio Astronomy Explorer-B

The Radio Astronomy Explorer (RAE-B) spacecraft (also known as Explorer 49, launched June 10, 1973) was a duplicate spacecraft of RAE-A which was launched July, 4 1964. The mission was to measure the intensity of celestial radio sources. RAE-A was successful in mid-Earth orbit at approximately 5850 km at 120.6° inclination. Both RAE-A and RAE-B were gravity gradient stabilized with very long (750 feet) tape booms in V-shaped pairs that extended towards the Earth or Moon and towards zenith, with a third smaller pair of pivoted booms for gravity gradient dampening (see Fig. 11). The maximum satellite dimension was 1,500 feet.

In that era, there usually was enough of a budget for programs to build two spacecraft. Since RAE-A was successful and RAE-B was already built, it was decided to use RAE-B in lunar orbit. In order to accomplish this, a hydrazine “bolt-on” propulsion module was added to perform velocity correction on its way to the moon and for lunar orbit insertion. In its initial Earth orbit during lunar transfer and during the lunar orbit insertion burn, the spacecraft was spin stabilized. The GSFC GN&C Branch was asked to analytically validate the spin dynamics of the spacecraft in this new configuration.

The hydrazine velocity control propulsion system being added was well below the CG of the spacecraft, and each of its four tanks were inter-connected to each other with a pressurized gas line and fuel line so that its fuel load would be evenly distributed. While performing the analysis, one of my colleagues, Dr. Thomas Flatley, discovered that the combined effect of the CG distance and the gas / fuel interconnected lines would cause a ‘cascade effect’. A small principal-axis misalignment in the system would cause fuel to migrate to the “lower” tank as depicted in Figure 12. This would cause additional principal-axis misalignment, which would continue until the system reached equilibrium, and the principal axis of the spacecraft would have been shifted approximately 14° with respect to the spacecraft’s geometric spin axis. This potential problem was discovered prior to launch. The solution turned out to be fairly simple to implement. The gas interconnects were crimped so that they did not allow the gas pressure to equalize. The slight pressure differential prevented additional fuel from migrating and causing the principal axis tilt. The mission was successfully conducted without a hitch.

This fuel migration phenomenon has occurred to a lesser extent on synchronous communication satellites, and if not fixed on RAE-B would have probably resulted in mission failure.

International Ultraviolet Explorer

The International Ultraviolet Explorer (IUE) satellite (see Fig. 13 and Fig. 14) was an international spaceborne ultraviolet astronomical observatory. It was launched January 26, 1978 into a geosynchronous orbit over South America. The IUE observatory had a mass of 669 kg and a nominal power output of 424 Watts. The science payload consisted of a 45-cm telescope solely for spectroscopy in the UV wavelength range of 1,150 to 3,250 A. The satellite and optical instrumentation were provided by NASA. The UV detectors, were provided by the United Kingdom and the European Space Agency (ESA) supplied the solar arrays. European Control Center was Villafranca del Castillo Satellite Tracking Station (VILSPA) near Madrid, Spain). From its geosynchronous orbit, which was neither circular nor equatorial, the observatory maintained continuous telemetry and command communications with the NASA/GSFC. After launch, two-thirds of the observing time was directed from the control center at NASA/GSFC making a big loop in the south eastern sky. It was within sight of VILSPA approximately eight hours per day; and one-third of the time the satellite was operated from the European Control Center VILSPA.

IUE had a design life requirement of three years and a goal of five years. I insisted that a three year life would require six gyros to guarantee three working gyros at the end of three years. The IUE gyro procurement called for 18 gyros (one flight six-pack, one protoflight six pack, and six spares) for a total fixed price contract of $1.8 million. Because of the tight power and weight requirements Bendix had to perform significant new design and development resulting in a loss on the fixed price contract. We flew the best six gyros on IUE. After the launch, NASA Headquarters ordered us to give the remaining 12 gyros to Marshall Space Flight Center (MSFC) for use on Hubble. MSFC returned the gyros to Bendix for rework to make them more sensitive. Hubble was literally flown on residual IUE inventory. Bendix got well on Hubble.

IUE, being in a geosynchronous orbit, had two eclipse seasons a year. Normal solar array degradation after the third eclipse season (1979) did not permit full science operation with all six gyros running so the scientists insisted on shutting down three gyros. I objected because at that stage in my career I had never seen a gas bearing gyro quit working but I saw many that would not start. When the gyros were turned back on after the eclipse season only two of the three gyros started running. I had no argument from the scientists about shutting gyros down for the next eclipse season. In March 1982 an electronic failure required that removal of the second gyro from the control loop. The third gyro failure occurred on July 27, 1982 (4½ years after launch).

At this time IUE was being operated two shifts a day from GSFC and one shift by the ESA from the VILSPA outside of Madrid, Spain. In late 1982, VILSPA was operating only one satellite (IUE) and if it failed there was a good chance the station would be closed.

My branch at GSFC took on the task of developing a two gyro control law, which was considered impossible for a sub arc second pointing satellite. With only two precision sensors (gyros) it was necessary to use one axis of the fine digital sun sensor for the third axis to control the 3-axis spacecraft. The trick was to get sub arc second stability when the third axis sensor had a least significant bit (LSB) of 20 arc seconds. This concept is covered in Reference 5. Eighteen months later we had a two gyro control law and VILSPA thought Goddard walked on water. On Sunday (always a weekend) August 18, 1995 the fourth gyro failed. The new control laws were uplinked and debugged. The spacecraft operated well on two gyros with sub arc second performance. After the fourth gyro failure there was a demand for a single gyro control. This was an easier development than the two gyro control law. The work had already been done to fly one axis on the sun sensor. For one gyro control all that had to be done was to fly one gyro with two axes on the sun sensor. The single gyro control law was actually checked out and worked well onboard the spacecraft. It was never used operationally because the spacecraft was decommissioned before the fifth gyro failed. The design goal of five years was easily met with 18 years of operation.

After developing the one gyro control we then developed a zero gyro control law. This control would have kept the IUE power safe and thermal safe, but it would not have satisfied mission science pointing requirements. I will come back to this zero gyro control law later in this paper when I talk about the SOHO loss of attitude anomaly (see VII, B).

Solar Maximum Mission

The Solar Maximum Mission (SMM) observatory (Fig. 15) was launched on 14 February 1980 into a circular 574 km sun synchronous orbit on a Delta Expendable Launch Vehicle (ELV). It was designed to provide coordinated observations of solar activity, in particular solar flares, during a period of maximum solar activity. The payload was made up of seven instruments, specifically selected to study the short-wavelength and coronal manifestations of flares.

The SMM observatory was designed and built as an in-house GSFC Space Science mission. An important SMM Project objective was to develop the Multimission Modular Spacecraft (MMS) technology as a generic spacecraft bus for meeting not only the SMM-unique requirements but also those of a large segment of future high-accuracy NASA Earth and Space Science missions. It is noteworthy that the SMM vehicle was the first satellite flown that was ELV-launched and Shuttle retrievable. Furthermore, as will be discussed later, the SMM vehicle, like all NASA MMS-class spacecraft, was purposely designed to be serviced and repaired on-orbit by Shuttle astronauts.

The modular SMM observatory had a mass of 2,315 kg and measured approximately 4 m in length, fitting into a circular envelope 2.3 m in diameter. It consisted of two major elements: 1) a MMS bus element and 2) the SMM mission unique elements. The MMS spacecraft bus provided essential support subsystems which maintain the overall functioning of normal spacecraft activities. The mission unique elements include the experiment module containing the science instrument complement and associated electronics, the solar array, communications antennas and launch vehicle adapters. The MMS spacecraft was a NASA Standard on-orbit serviceable bus that consisted of modular support structure (MSS), a Modular Power Subsystem (MPS), a Signal Conditioning and Control, a modular Communications and Data Handling (C&DH) Subsystem, a Modular Attitude Control Subsystem (MACS), and an optional Propulsion Module (PM) with an auxiliary tank. The version of the MMS employed for the SMM mission did not include the optional PM.

The SMM zero-momentum Attitude Determination and Control System (ADCS) consisted of the MACS that contain the basic hardware components, a distributed set of Coarse Sun Sensors (CSSs), and the Fine Pointing Sun Sensor (FPSS) in the science instrument module, and the ADCS flight software resident in the NASA Standard on-board flight computer in the MMS C&DH module. The FPSS provided 0.11-arc-second resolution solar-pointing data over a linear range of ~ 0.5 degrees. The MACS module contained four Reaction Wheel Assemblies (RWAs). Three of the RWAs were orthogonally mounted in the MACS module whereas the fourth was mounted in a skewed orientation for redundancy. Each RWA provided 0.15 N-m of control torque and 20 N-m-second of angular momentum storage.

Two Fixed-Head Star Trackers (with 8-degree square fields of view and 7 arc-second resolution) and a Dry Rotor Inertial Reference Unit (DRIRU) containing three two-axis high-performance gyroscopes, were mounted on a structurally and thermally stable optical bench inside the MACS. Additionally, the MACS contained three orthogonal Magnetic Torquer Bar (MTB) pairs producing a 2 x 50 A-m² dipole on each axis. The MTBs were used to unload stored RWA momentum based upon in-situ measurements of the Earth’s magnetic field from two threeaxis magnetometers located inside the MACS module. The MTBs could also be used to generate control toques to rate-damp the spacecraft using the so-called “B-Dot” control law with inputs from the magnetometers for feedback. The B-Dot control law is a very simple technique to de-tumble or de-spin a spacecraft. It relies on magnetic coils or torque rods as control actuators. The MACS B-Dot Safe Hold Mode (SHM) control law is based on the measurement of the rate of change of body-fixed magnetometer signals. Using only a magnetometer, MTB, and a magnetic moment generator, the B-Dot controller de-tumbles the spacecraft relative to the Earth's magnetic field vector. The fundamental feedback signal used in the B-Dot controller is the rate of change of magnetic field vector components as measured by on-board, body-fixed magnetometers. Since " B " is commonly used to denote the Earth's magnetic field, it follows that the associated rate of change of the magnetic filed is dB/dt, and is often written in the form B . Thus, the origin of the "B-Dot" terminology. B-Dot can be thought of as making molasses out of the Earth’s magnetic field.

The RWAs were four for three redundant and were individually fused. After a few months in orbit the first RWA fuse blew. No problem. We still had three remaining. After about nine months in orbit the second RWA fuse blew and the spacecraft was no longer three axis stable. A review of these failures showed that the fuses were “designed to blow”. Normally on the ground, fuses are sized at about twice the current that they are expected to carry. If they are to be used in space the rating should be doubled again because the air cooling is lost in the vacuum of space when the fuse outgasses. The contractor was tasked, in one of the many design reviews, to justify the fuse sizing. The contractor brought out some old documentation as justification without looking at the fact that some additional loads had been added to the fuses. As a result, the space derating of a factor of two was lost and the fuses were literally designed to blow.

The only control remaining on the spacecraft were the torquer bars and they had no control about one axis (the magnetic field lines). Dr. Thomas Flatley devised control laws that would spin stabilize the spacecraft at 1°/sec about the minimum inertia axis I_min, damp nutation by pumping the energy state up to the maximum (see III C), and precessing the momentum vector to the sun. Since the momentum was in the I_min axis, which was close to the experiment axis and the intended sun pointing axis, the spacecraft was power safe and thermally safe. The spacecraft was never intended to be spin stabilized. It was never spin balanced. The estimated mass properties placed I_min about 7° off the experiment axis. With this 7° pointing error no science was achievable but the spacecraft could remain alive for an extended period of time until repairs could be made.

1980s

Tracking and Data Relay Satellite System

The Tracking and Data Relay Satellite System (TDRSS) is NASA’s communication signal relay system which provides tracking, telemetry and command data relay services between earth orbiting spacecraft and ground control stations or data processing facilities. Back when it was implemented the TDRSS concept represented a revolutionary new way of tracking Earth-orbiting spacecraft, including the Shuttle, and transmitting their data back to Earth. TDRSS serves to provide real-time contact with space platforms when they are physically out of view of groundbased tracking stations. It allowed NASA to close many of its tracking stations that were located around the world. The TDRSS ground segment is located near Las Cruces, New Mexico, and is known as the White Sands Ground Terminal (WSGT). The Tracking and Data Relay Satellites (TDRSs) comprise the communication satellite component (also called the “space segment”) of the overall TDRSS. The TDRS satellites are all located in geosynchronous orbit. “Forward” data is uplinked from the WSGT to the TDRS and from the TDRS to the User spacecraft. “Return” data is downlinked from the User spacecraft via the TDRS to the WSGT and then on to the designated data collection location. The TDRSS provides near full-time coverage not only for the Space Shuttle Orbiter vehicle, but also for up to twenty-five other orbiting spacecraft simultaneously. The fully operational TDRSS constellation comprises three on-orbit satellites positioned near the equator, with two stationed 130 degrees apart in longitude and a third TDRS located centrally between them as an on-orbit spare satellite.

The first generation of TDRSs consisted of six TRW (now Northrop Grumman) designed and built satellites, namely TDRS-1 along with TDRS-3 through TDRS-7. The three second generation satellites, TDRS-8, -9, and -10, were designed and built by Hughes (now Boeing). Thus the current TDRSS constellation consists of nine working on-orbit Tracking and Data Relay Satellites located in geosynchronous orbit. The other TDRSs in the constellation provide ready backup in the event of a failure to an operational spacecraft and, in some specialized cases, resources for target of opportunity activities.

The TRW-produced TDRS satellites were Space Shuttle launched. An Inertial Upper Stage (IUS), which was a two-stage solid rocket managed by the Air Force, was used to propel the early TDRS satellites from the lower Shuttle orbit to the higher geo-synchronous orbit. The later generation of TDRSs has used Atlas expendable boosters to launch the satellites into orbit.

TDRS-1 was launched on April 5, 1981 as the primary payload on the Space Shuttle mission STS-6. TDRS-1 had an on-orbit mass of 2,268 kg and a nominal power output of 1,700 Watts. TDRS-1 measured almost 60 feet across the fully deployed solar panels. The TRW-produced spacecraft employed a momentum-bias ACS using two momentum wheels in a “V” configuration in the pitch-roll plane to provide gyroscopic stabilization of the spacecraft.

Dr. Tom Flatley and I watched the STS-6 Shuttle launch at GSFC on NASA Select TV (as we did for the TDRS-1 through TDRS-7 launches) before leaving for the airport to catch a plane to the WSGT facility to directly monitor the satellite injection and deployment into synchronous orbit. This was possible because TDRS was not deployed from the shuttle (see Fig. 16) until after two or three orbits and then it had a 6 ½ hour transfer orbit before reaching synchronous altitude. This gave us enough time to watch the liftoff on TV and still get to WSGT in time for deployment. If the Shuttle didn’t lift-off, we didn’t lift-off.

We walked into the WSGT near Las Cruces around midnight, just after the TDRS-1 IUS failed. The TDRS was a NASA satellite launched on a NASA shuttle and even though it was an Air Force rocket failure the Air Force was perfectly willing to keep quiet and let NASA take all the heat for the failure.

The second stage of the IUS had a steerable nozzle supported on a fluid filled toroid like a small inner tube. The toroid sprung a leak and the nozzle went “hard over” and spun the spacecraft up to about one revolution per second (rps). The Air Force control center was finally able to get commands in that allowed satellite separation. After separation the satellite was left spinning at about 1 rps with a synchronous apogee but a perigee about 8,600 miles low. After separation the spacecraft was able to autonomously despin itself and acquire the sun. It was now power positive and thermally safe at this time.

By this point in time the whole crew was pretty well drained and it was decided to “bag it” for the night. We left instruction to the ground terminal crew to monitor the satellite for the night and to call our hotel if there were any changes. Tom Flatley, Jim Moore (the TDRS System Engineer), and I went to dinner. When we returned to the hotel we checked for messages and there were none.

The next morning we went to the ground terminal, walked into the lobby, and there on live TV was the NASA Headquarters TDRSS Program Manager (Bob Aller) trying to explain to the world how they blew up a thruster the night before. That was the first we had heard of it.

The orders to the ground terminal were to leave the satellite in the power positive sun pointing mode. Because everything was going well the ground terminal crew decided to proceed with the mission and commanded the satellite into Earth acquisition. But all was not well. The orbit was eccentric and because of the low perigee the Earth appeared to be about 27° in diameter at perigee as opposed to the synchronous altitude of 17.5° for which the Earth sensor was designed. This caused erratic firing of the pitch thrusters, which overheated the thrusters. Everyone knows that qualification temperatures are temperatures that the hardware is never expected to exceed, so the telemetry displays in the control room were limited to qualification temperatures (240° F). But the true temperature was much higher (340° F) and caused detonation of the thruster. The true temperature was telemetered by the spacecraft but not displayed in the control room.

TDRS was designed to be capable of a geo-stationary orbit, which would require both north-south and east-west station keeping. Without east-west station keeping the satellite could move completely around the Earth. Lack of north-south station keeping causes the orbit to tilt about ¾° per year. East-west requires a velocity correction of somewhere between zero and seven feet per second per year (4.78 mph) depending on longitude. North-south requires 200 feet per second per year (137 mph) regardless of longitude. The north-south requirement went away before launch but the spacecraft was flown with a full fuel load, which was about 30 times of that required to make mission. This was fortunate because the extra fuel was more than enough to reach mission orbit in spite of the IUS failure. However, the only thrusters on board were one pound force thrusters and the spacecraft weighed about 5,000 pounds. We raised perigee about 8,600 miles with two one pound thrusters. It took about four months and 39 apogee burns, some as long as 180 minutes. It took a total burn time of 44 hours, consuming about 800 pounds of propellant, as well as an adaptable, robust and flexible ACS design and much resourcefulness from ground operators to accomplish that recovery feat.

TDRS-1 is a special satellite (see Fig. 17). Though wounded the night of its launch TDRS-1 is still alive today. It is a favorite of the Nation Science Foundation (NSF) because over the last 26 years its orbit has tilted to about 12.8 degrees, making it capable of delivering wide band data from the NSF South Pole Station for up to six continuous hours per day.

The TDRS-2 spacecraft was lost on the STS-51L Challenger accident in January of 1986. I had plane tickets in my pocket to support TDRS-2 from WSGT but the tickets never got used.

SMM Servicing

As described earlier in this paper the SMM mission suffered several on-orbit failures, including the loss of all four MACS RWAs due to an improper fusing problem. The SMM, like all MMS-based NASA spacecraft, was designed from the start to be serviced on-orbit by Shuttle astronauts (see Fig. 18). A Shuttle repair mission was planned and launched (STS-41C, 6 April 1984) by NASA with the twin goals of replacing both the spacecraft’s MACS module and the coronagraph's main electronics box. A few days after launch the Shuttle Orbiter Challenger rendezvoused and retrieved the SMM spacecraft.

You should recall from the earlier SMM discussion (V, D) that, following the loss of the RWAs due to the blown fuses, the SMM was spin-stabilized at a rate of one degree per second. The astronauts wanted us to stop the spacecraft spin so they could capture it. We agreed to slow the spin to 0.1° per second but the astronauts wanted zero spin rate. I pointed to the clock on the wall and said, “You mean to tell me you couldn’t catch the minute hand (not the second hand) on the clock because it’s spinning too fast (0.1° per second)?” They agreed to 0.1° per second.

During an Extra Vehicular Activity (EVA) Shuttle astronaut (George “Pinky” Nelson) attempted to grapple SMM. However the original grapple device didn’t work. When Pinky touched the spacecraft it moved 90° to the direction of the contact and he screamed back to the ground “turn it off, turn it off”. He forgot about the gyro dynamic. The spacecraft was a gyro even though its spin rate was only 0.1° per second (one revolution per hour). Pinky asked permission to try to stop the spacecraft. By design, all communications with the astronauts are funneled through Johnson Space Center (JSC). The Goddard Control screamed “don’t touch it, don’t touch it”. By the time the word went from Goddard to JSC to the Shuttle and out to Pinky the Shuttle Commander had already given him the OK. He grabbed the solar array and not only stopped it but tumbled it in the opposite direction about twice as fast. By now the EVA was running out of time and Pinky had to retreat to the Shuttle. We were left with a tumbling spacecraft.

I was called at home on a Sunday evening by the Guidance and Control Engineer (John Azzolini) who was in the Goddard SMM Control Center during the attempted recovery of SMM. After lengthy technical discussions on what strategy we might employ to restabilize SMM it was decided to use the B-Dot controller (see V, D) to detumble the vehicle. The only problem was that the B-Dot controller was not loaded in the on-board flight computer. As previously mentioned the B-Dot is a very simple controller and actually only required about a dozen Lines of Code (LOC) in flight software. Ground controllers took steps to upload these few lines of flight software code to the spacecraft. This step was not without some complications however. As it turned out the few lines of B-Dot controller code were not easily available in a stand-alone module or routine. In fact the B-Dot controller logic was embedded in a much larger (~10,000 LOC) flight software build containing all the ADCS-related code. We debated the risks of, and the time required to, extract the small portion of needed B-Dot code from the larger flight software package. In the end we decided to simply upload the entire ~10,000 LOC in order to implement the ~12 LOC for BDot control to de-tumble spacecraft.

The upload took several orbits. Once the software was uploaded I made the call from home to enable the B-Dot SHM immediately without verification because the spacecraft was running out of power and there was no time for verification. The spacecraft was successfully detumbled and spin stabilized at 0.1° per second. The astronauts successfully captured SMM the next day with the Remote Manipulator System (RMS), brought it into the shuttle bay, replaced the MACS module, and redeployed it into orbit.

Thus concluded the first ever on-orbit satellite repair. It is worth noting that the lessons learned from the pioneering repair of the SMM spacecraft were later applied by GSFC engineers to the on-orbit servicing of the Hubble Space Telescope.

Following the successful repair mission the SMM observatory went on to collect science data until 24 November 1989. It subsequently re-entered on 2 December 1989.

Cosmic Background Explorer

The Cosmic Background Explorer (COBE) satellite was developed in-house by NASA's Goddard Space Flight Center. Its mission was to measure the diffuse infrared and microwave radiation from the early universe (generally considered a relic of the Big Bang) to the limits set by our astrophysical environment. Mission requirements dictated that precise measurements of the diffuse radiation be taken between 1 micrometer and 1 cm over the whole celestial sphere. COBE carried three science instruments to search for the cosmic infrared background radiation, to map the cosmic radiation sensitively, and to compare the spectrum of the cosmic microwave background radiation with a precise blackbody. The following quantities were measured: (1) the spectrum of the 3° K radiation over the range 100 micrometers to 1 cm; (2) the anisotropy of this radiation from 3 to 10 mm; and, (3) the spectrum and angular distribution of diffuse infrared background radiation at wavelengths from 1 to 300 micrometers.

The COBE experiment module contained the instruments cryogenically cooled by a dewar filled with 650 liters of 1.6° K (-250°C!) liquid helium, with a conical sun shade. The cooler was an open ended refrigeration system cooled to ~3° K by boiling away liquid helium. The helium was intended to last for one year. If the sun shade were to tip toward the sun for a few minutes it would boil away several days worth of helium. The spacecraft bus module contained the attitude control, communications and power systems and other supporting subsystems.

Originally COBE was intended to be launched on the Shuttle into a near polar sun-synchronous (6am–6pm) orbit from Space Launch Complex-6 (SLC-6) at Vandenberg Air Force Base (VAFB) California. However, as a result of the Shuttle Challenger accident in January 1986, all plans and preparations for Shuttle launches from VAFB were terminated. Consequently, COBE was switched to a Delta expendable launch vehicle. This required the team to perform significant amounts of analysis and re-design to accommodate COBE within the mass and volume constraints of the Delta. The final COBE satellite had a total dry on-orbit mass of 2,206 kg, a length of 5.49 m, and a diameter of 2.44 m with Sun-Earth shield and solar panels folded (8.53 m with the solar panels deployed). COBE had nominal power output of 750 W. The COBE satellite did not have any on-orbit propulsion capability. The propulsion module originally designed for COBE when it was to be Shuttle launched was not required for the Delta launch.

Figure 19 is a drawing of the redesigned COBE satellite with its solar panels unfolded and extended outwards from the main body of the spacecraft. At the top of the satellite is the sunshade, consisting of golden-colored sheet, roughly in the shape of a funnel. This sunshield prevented sunlight from shining onto the cold part of the satellite where the science instruments (including a dewar of cryogenic helium) were mounted.

The satellite was rotated at 0.75 rpm about the axis of symmetry to control systematic errors in the anisotropy science measurements and to allow observations of the zodiacal light at various solar elongation angles. The orientation of the spin axis was maintained anti-Earth at 94 degrees with respect to the Sun line. Thus with the combination of the spacecraft’s orbit precession and its spin-axis orientation, the science instruments were able to perform a complete scan of the celestial sphere every six months.

The ACS was basically unchanged from the shuttle design except for the fact that the thruster valve drive electronics was no longer needed (no thrusters). The pointing requirement to always keep the experiment in the shade was so strict that it demanded the highest level of reliability from the ACS. There can be three levels of reliability for an ACS: 1) No single point of failure (can be reconfigured by ground command after any single failure), 2) Fail safe (spacecraft remains power and thermally safe without ground intervention after any single failure), and 3) Fail operational (spacecraft continues fully operational after any single failure). COBE was designed to level 3, to be fully operational in the presence of any failure. COBE was nominally a zero momentum spacecraft. The ACS was implemented using two yaw momentum wheels for redundancy. The wheels were aligned along the spacecraft spin axis. These wheels carried an angular momentum opposite that of the spacecraft rotation to create a nearly zero net angular momentum system. The spacecraft orientation was controlled by three reaction wheels with spin axes 120 degrees apart in the plane perpendicular to the spacecraft spin axis. The wheel momentum was unloaded by magnetic torquer bars. Earth and Sun sensors (one of each on each of the three transverse control axes) provide control signals to point the spacecraft spin axis away from the Earth and at least 90 degrees from the Sun. Rate damping and fine resolution attitude sensing were provided by six gyros, one on each transverse control axis and three on the spin axis. Coarse attitude parameters were calculated on the ground by using telemetered data from the attitude control sensors to produce attitude solutions good to 4 arcmin (1 sigma). The fine aspect was determined using gyro data to interpolate between the positions of known stars detected in the short wavelength bands of the Diffuse Infrared Background Experiment (DIRBE) instrument. The fine aspect solution has an accuracy of 1.5 arcmin (1 sigma) and is used in the analysis of data from all three instruments.

Pitch (relative to the Earth) and roll (relative to the Sun) are controlled by the three transverse axis control loops. Since only two are required to control pitch and roll any one of the three axes can sustain a hard failure and the two remaining will control the spacecraft. In the case of yaw, both yaw wheels are run at half speed. In the presence of a hard failure (i.e. a seized bearing) the wheel would stop and the spacecraft would slow down from 0.75 rpm to 0.375 rpm but still under full control. Remember the conservation of momentum. Ground control could recover the 0.75 rpm at anytime by doubling the speed of the remaining wheel.

The COBE spacecraft was launched on November 18, 1989 into a dawn-dusk sun-synchronous orbit. Less than one week after launch the spacecraft came up over the horizon with a hard over gyro failure on one of the transverse axes, still fully operational and in spec. That is exactly what the spacecraft was designed to do but it didn’t have to demonstrate that capability in less than one week.

COBE science instrument operations were terminated in December of 1993 and spacecraft engineering operations were concluded shortly thereafter. The operation of the spacecraft was then transferred to GSFC’s Wallops Flight Facility (WFF) for their use as a test and tracking satellite.

Clearly COBE was an extremely successful astronomy mission; each COBE instrument yielding a major cosmological discovery. I personally was elated to hear, in October of 2006, that Dr. John Mather, the COBE Project Scientist from GSFC, had won the 2006 Nobel Prize for Physics, awarded by the Royal Swedish Academy of Sciences. To date, COBE has produced the most conclusive evidence of the Big Bang theory. The first-of-a-kind science measurements obtained by the COBE satellite not only reinforced the theory behind the “Big Bang” but also offered clues as to how and when the first galaxies came into being. “These measurements…marked the inception of cosmology as a precise science,” the Nobel jury said in its award citation. No less an authority than famed British physicist Stephen Hawking has said the results from COBE were “the greatest discovery of the century, if not all times”.

I recommend Dr. Mather’s book (The Very First Light, by John C. Mather and John Boslough, Basic Books, New York, 1996.) to those readers interested in a very readable and insightful account of the COBE mission development and operation.

Ulysses

Ulysses (Fig. 20) was a joint mission between ESA and NASA, and was to fly two spacecraft (one built by ESA and one built by NASA) on a NASA rocket. They were to be flown with a Jupiter gravity assist into a heliocentric orbit with a high inclination relative to the ecliptic (see Fig. 21). One was to go under the South Pole and one over the North Pole of the Sun. The Mission was to explore the polar regions of the Sun. NASA canceled their spacecraft for budgetary reasons but ESA went ahead.

The total spacecraft weight was 370 kg including 55 kg of payload and 33 kg of propellant. Its stowed dimensions were a length of 3.2 m, a width of 3.3 m, and a height of 2.1 m. It was electrically powered by a Radioisotope Thermal Generator (RTG). The spacecraft was spin stabilized with a fixed dish (high gain antenna) pointed towards the Earth for the data link.†††

Ulysses was launched October 6, 1990 with a primary mission from October 1990 through September 1995, which included the Jupiter flyby and one South Pole pass and one North Pole pass of the Sun. Ulysses operated normally for about one month with proper operation of the passive nutation damper. Minutes after the 7.5 m axial boom was deployed out the back of the spacecraft (see Fig. 22), Ulysses began an unexpected nutation, which grew to 7° peak-to-peak.

Even though GSFC had no responsibility for the design and development of the Ulysses, I received a call from NASA Headquarters asking if we could look into the problem. There were numerous international teleconferences between the European Space Research and Technology Center (ESTEC), Noordwijk, Netherlands; European Space Operations Center (ESOC), Darmstat, Germany; Jet Propulsion Lab (JPL), Pasadena, California; GSFC and NASA Headquarters. I told them immediately that they had a Sun driven thermal problem (remember S³). There had to be an energy source to pump up nutation and the only significant source millions of miles into space was the Sun. I was invited to present this story to the NASA Administrator, Admiral Richard Truly. I said I was sure I could convince Admiral Truly of the possibility of Sun driven nutation. I really did not want to meet with Admiral Truly at that time because the problem was only a few days old and I could not answer the next question… “How does this affect Ulysses?” But AdmiralTruly was the boss and I agreed to go to NASA Headquarters. Truly canceled the meeting because of a conflict. At 10 a.m., the Tuesday before Thanksgiving, my office received a call from Truly’s office asking if I could I come down for a 2 p.m. meeting that afternoon. By that time, with the help of JPL trajectories and spacecraft shadow angles on the boom Dr. Flatley in my shop had developed analytically the destabilizing mechanism. The boom was predicted to go into shadow behind the spacecraft before Christmas. I went into Truly’s office and predicted that there really was a Santa Claus and he was going to visit 40 million miles out in space and fix the spacecraft. The nutation would stop before Christmas. The NASA Ulysses Program Manager (Bob Murray) challenged me to a wager of a couple drinks. I accepted with cessation date of December 18. The Ulysses had a Conical Scan (ConScan) mode, which precessed the spin axis and thus the antenna beam toward the Earth using thrusters. Because this mode had to be nutationally stable it damped the nutation whenever it was activated but the mode could not be left on because of fuel consumption. The nutation would return when ConScan was turned off. On December 18 at 2200 Greenwich Mean Time (GMT) ESA activated ConScan and the nutation disappeared as usual, but did not return when ConScan was turned off. I won my drinks by two hours GMT. I was prepared to go for Eastern Standard Time (EST) to gain another five hours but it was not needed.

The analytical model showed the nutation forcing function to be proportional to the cosine of the angle between the boom and the sun line reduced by the portion of the boom in shadow behind the spacecraft. For angles less than 90° the nutation forcing function is destabilizing and for angles greater than 90° the cosine changes sign in it becomes stabilizing. There was no fix for the problem but the analytical understanding defined the critical regions of the heliocentric orbit when the nutation instability would occur and helped immensely in scheduling mission operations.

My Santa Claus prediction made a believer out of Massimo Trella, the ESA Inspector General (IG) (see SOHO VII, B). Unlike the NASA IG, the ESA IG is a technical position equivalent to the ESA Chief Engineer with offices at ESA Headquarters in Paris, France.

Ulysses completed its primary mission in September 1995 (see Fig. 23) and was given its first extension of one heliocentric orbit (≈ 6 years) (see Fig. 24), its second extension in January 2002, and its third extension in October 2004 (see Fig. 25). Ulysses completed its third solar South Pole pass in April 2007 and will complete its third North Pole pass in March 2008. There will probably be no more extensions because of the reduction in available electric power. The RTG is decaying and may not provide sufficient power for another heliocentric orbit until 2014.

1990s

Geosynchronous Orbit Environmental Satellites

The first of the Loral series of Geosynchronous Orbit Environmental Satellites (GOES) was under contract in the early 1990s. The GOES is a geosynchronous weather satellite managed by GSFC for the National Oceanic and Atmospheric Administration (NOAA). The spacecraft mass was 1,850 kg of which 610 kg was payload. The maximum dimension was 9.5m with the solar array deployed. The ACS was a 3-axis momentum biased system. Loral’s SHM was to go to Sun pointing zero momentum on thrusters as they had done on several previous satellites. This is done by ground command and is an unforgiving mode if not done correctly. Three Loral satellites were lost for three different problems, but all because of an unforgiving SHM and an inexperienced ground crew. I wanted a redesign of the SHM to make it more forgiving but Loral would not redesign it. I went to the GSFC GOES Project Manager (Rick Obenschain) and he agreed to direct Loral to redesign the SHM as per our direction. GSFC paid the full costs plus fee. The GSFC directed redesigned mode maintains the momentum bias and uses no thrusters. Any thruster mode is unforgiving if not done exactly correctly.

GOES-I was launched on April 13, 1994 (see Fig. 26). I wanted an in orbit checkout of the SHM because it was a GSFC directed design. I did not want to turn the spacecraft over to NOAA and have problems with SHM because Loral would claim “Goddard made us do it”. However, the Goddard Center Director (Dr. John Klineberg) was in a mode of don’t “screw around” with a working space. He and I had many battles on this one and as you can imagine, I lost. I did get my wish, however, on a “dark and stormy night” in the wee hours of the morning on a weekend when the ground crew enabled a new, recently uploaded, software package, and the computer crashed. The ground crew commanded the spacecraft to SHM and it was completely successful. The “SHM test” was very realistic and much more stressful than we would ever have been permitted to run for test and checkout.

Solar Heliospheric Observatory

The Solar Heliospheric Observatory (SOHO) Project was carried out by the ESA and NASA as a joint scientific collaborative effort between the two agencies to perform helioseismology (i.e., to study the internal structure of Sun) and monitor the solar atmosphere, corona and wind. ESA’s responsibilities included the spacecraft development, and integration & test of the full observatory. NASA was responsible for the launch services, the launch vehicle, the ground system for on-orbit operations, and for conducting mission operations. The SOHO spacecraft was designed and built by a European industrial team led by the Matra Marconi Space (MMS) company. The payload instruments were provided by both European and American scientists. Mission operations are based at NASA Goddard Space Flight Center in Greenbelt, Maryland with telemetry and command links provided by NASA's Deep Space Network (DSN). The total mass of the SOHO observatory at launch was 1,850 kg including a science instrument payload of 610 kg. The SOHO observatory is depicted in Figure 27. With its solar array fully deployed the SOHO vehicle had a maximum dimension of 9.5 meters.

The SOHO observatory was launched on December 2, 1995 into its mission orbit about the 1st Sun-Earth Lagrange Point (L₁), which is an equilibrium point about 1.5 million km from earth in the direction of the Sun. Approximately 2,000 hours of flight time were needed for the SOHO spacecraft to arrive on-station about the L₁ point. From this vantage point the SOHO science instruments have an uninterrupted view of the Sun. SOHO was declared fully operational in April 1996 and successfully completed its two-year primary mission in May of 1998.

As part of its three-axis stabilized ACS design the SOHO spacecraft employs a suite of four RWAs. A single SOHO RWA is depicted in Figure 28. During pre-launch ground testing at ESTEC in the Netherlands, two of the four original RWAs failed with less than 1,000 hours of accumulated operating time. After reviewing these failures the ESA SOHO Project office planned to only re-build the two failed RWA units. In ESA’s mind the other two original RWAs (the ones that had not failed in ground test) were acceptable for flight on SOHO because they “met specification”.

The GSFC SOHO Project Manager (Ken Sizemore) came to me with concerns about the reliability of the wheels. I pointed out that the specification was meaningless because half of the wheels had already failed in less time than it takes to get on station at the L₁ point (see Fig. 29). I was convinced that there would have been no viable mission if ESA flew SOHO as they proposed. When ESA refused to listen to GSFC and rework all four wheels I called the ESA IG (Massimo Trella) (see VI, D) at his ESA Headquarters Office in Paris on a Monday afternoon. By the end of the week ESA had a “change of heart”. All four wheels were returned to the vendor for teardown and redesign of the bearing and lubrication system. The spacecraft was shipped to Kennedy Space Center (KSC) without wheels. After wheel refurbishment the wheels were reinstalled at KSC. To date, SOHO has been operating for more than 100,000 hours (11.5 years) on wheels 1, 2, and 3. Number 4 is periodically checked but not used in the control loop. It is kept as a spare.

The SOHO observatory entered into its extended mission phase in May of 1998 following completion of its 2-year primary mission. After over two years of nominal flight operations, command and control of the SOHO vehicle was lost on 25 June 1998. The spacecraft entered into a flat spin that resulted in the telemetry & command communications antennas pointed away from Earth and with the solar array oriented edge-on to the Sun. The SOHO spacecraft was therefore in the dire condition of not being able to communicate with mission controllers and with very little electrical power being generated. The spacecraft temperatures dropped and froze the gyros and the hydrazine. This very serious spacecraft anomaly was preceded by a routine calibration of the spacecraft's three gyroscopes (i.e., the A, B, and C gyros) and by a RWA momentum unloading event.

The spacecraft roll axis is normally pointed toward the Sun, and the three gyros are aligned to measure incremental changes in the roll attitude. Gyro calibrations are performed periodically to accurately determine the draft bias associated with each of the three roll axis gyros. Once these biases are determined, the bias values are uplinked to the spacecraft computer where they are subtracted from the gyro measurement and used by the Attitude Control Unit (ACU) to determine the actual motion of the spacecraft and to maintain the correct orientation. The gyros are not required during normal mission operation. They are used only for thruster-based activities such as roll attitude hold during station keeping, momentum management, Initial Sun Acquisition (ISA) and Emergency Sun Reacquisition (ESR). The station keeping maintains the spacecraft near the L₁ point. Momentum management, performed approximately every two months, maintains the reaction wheel speeds within prescribed limits.

The anomaly occurred as the result of ground control command errors. With the solar arrays edge on to the Sun and no power or command capability, SOHO was forced to wait approximately ninety days for the Sun to “move” 90° and reestablish power. ESA was able to recover the spacecraft attitude and thaw out the hydrazine lines. However, the flotation fluid in the gyros froze and fractured electrical connections to the motor resulting in the loss of all gyros. This left SOHO in a zero-gyro state similar to the zero-gyro state that was designed for IUE (see V, C). Unlike IUE, SOHO did not require gyros for normal mission operation. SOHO did not require precision pointing for station keeping or momentum management where gyros would normally be required. Therefore, the IUE zero-gyro mode worked well for SOHO even though it would not have worked for the precision pointed mission operation for IUE. ESA used the IUE zero gyro mode without giving any recognition to GSFC. During the planning and review meetings in Toulouse France I was dis-invited by name after I made the “end run” around the ESTEC Project Office. Without that “end run”, which forced the ESA Project Office to redesign the RWA bearing and lubrication subassemblies, there would be no SOHO today because the wheels would not have lasted through the primary two year mission phase.

After several extensions, SOHO is now approved for operation through 2009. They expect to get another extension. As of now (8/07) the wheels have operated over 100,000 hours.

Summary and Lessons Learned

Over the course of my six-decade long career in the field of spacecraft GN&C engineering I have formulated, at least informally, several fundamental “rules of thumb” or what could be called Lessons Learned. These were derived from some of the real-world spacecraft experiences I have described in this paper. Listed below are some of my “rules of thumb” which I share with the reader in the hope they may be of some practical value in their GN&C work:

• Conservation of momentum must always hold! (Explorer-I)
• If at all possible, join with Mother Nature, don’t fight her
• If at all possible, don’t autonomously fire thrusters (GOES SHM)
• Understand all the satellite dynamics and understand the operational environment
• In spin stabilized configuration, consider nutation as ‘structural resonance’ of system (SSS and Ulysses)
  • Look for disturbances at nutation frequency, not spin frequency
• Safety and reliability are opposing requirements
  • Remember 2 shotguns analogy (see SUBROC experience)
• Be persistent! If something is not right, say so! When faced with potential design flaws, be persistent with resolving these flaws—it could mean success or failure for mission (see the GOES SHM experience, SUBROC)
• When accused, the key 1st step is denial (see the OGO-4 experience)
• As a basic design philosophy, to avoid unnecessary system complexity as well as mass / power penalties, one should start the conceptual design of a satellite’s ACS based only on what is minimally needed for its normal mode of operations. Once that step is accomplished, additional diverse and/or redundant components can be included in the ACS design based on one’s understanding of allowable mission risk
• Reliability
  • Identify and eliminate all single point failures
  • Autonomous safe hold, ability to reconfigure around failure, and resume mission
  • Fail operational, be fully operational in the presence of any failure (see COBE)
• In real-time environment, once 1 bad thing happens, take time to think about recovery BEFORE making another decision (see the TDRS-1 experience)
  • In other words one should practice omphaloskepsis
• Don’t limit the telemetry displays. Make all the data that comes down from the spacecraft available in the control room

Acknowledgments

The author wishes to acknowledge the many contributions of both Neil Dennehy of the NESC and Stan Underwood of ATK Space and he sincerely thanks them for their steadfast support in conceiving, writing, and reviewing this paper. The author also thanks Joe Procaccino of ATK Space for his efforts in reviewing, editing, and preparing the final version of this paper. Lastly, the author also wishes to thank the NESC for providing the opportunity to capture and document his career experiences so they hopefully may be available for, and of use to, future generations of spacecraft GN&C engineers.

Acronyms and Symbols / Measurements

• AAP Angled Arrow Projectile
• ABMA Army Ballistic Missile Agency
• ACR anti-circular run
• ACS Attitude Control Systems
• ACU Attitude Control Unit
• ADCS Attitude Determination and Control System
• AEDC Arnold Engineering and Development Center
• APL Applied Physics Lab
• C&DH Communications and Data Handling
• CG center of gravity
• COBE Cosmic Background Explorer
• ConScan Conical Scan
• CSS Course Sun Sensor
• DIRBE Diffuse Infrared Background Experiment
• DRIRU Dry Rotor Inertial Reference Unit
• DSN Deep Space Network
• ELV Expendable Launch Vehicle
• ESA European Space Agency
• ESOC European Space Operations Center
• ESR Emergency Sun Reacquisition
• EST Eastern Standard Time
• ESTEC European Space Research and Technology Center
• EVA Extra Vehicular Activity
• FPSS Fine Pointing Sun Sensor
• GLGM Gun Launched Guided Missile
• GMT Greenwich Mean Time
• GN&C Guidance, Navigation and Control
• GOES Geosynchronous Orbit Environmental Satellites
• GSFC Goddard Space Flight Center
• IG Inspector General
• IGY International Geophysical Year
• IR infrared
• IRU Inertial Reference Unit
• ISA Initial Sun Acquisition
• IUE International Ultraviolet Explorer
• IUS Inertial Upper Stage
• JPL Jet Propulsion Laboratory
• JSC Johnson Space Center
• KSC Kennedy Space Center
• LOC Lines of Code
• LSB least significant bit
• LST Landing Ship, Tank
• MACS Modular Attitude Control Subsystem
• MIT Massachusetts Institute of Technology
• MMS Matra Marconi Space
• MMS Multimission Modular Spacecraft
• MPS Modular Power Subsystem
• MSFC Marshall Space Flight Center
• MTB Magnetic Torquer Bar
• NASA National Aeronautics and Space Administration
• NESC NASA Engineering and Safety Center
• NOAA National Oceanic and Atmospheric Administration
• NOL Naval Ordnance Lab
• NOTS Naval Ordnance Test Station
• NSF Nation Science Foundation
• OAO Orbiting Astronomical Observatory
• OGO Orbiting Geophysical Observatories
• OPEP Orbital Plane Experiment Package
• PM Propulsion Module
• RADAR RAdio Detection And Ranging
• RAE Radio Astronomy Explorer
• RMS Remote Manipulator System
• rpm revolutions per minute
• RTG Radioisotope Thermal Generator
• RWA Reaction Wheel Assembly
• SCR Signal Corps Radar
• SHM Safe Hold Mode
• SLC Space Launch Complex
• SMM Solar Maximum Mission
• SOEP Solar-Oriented Experiment Package
• SOHO Solar Heliospheric Observatory
• SSS or S³ Small Scientific Satellite
• SUBROC SUBmarine ROCket
• TDRS Tracking and Data Relay Satellite
• TDRSS Tracking and Data Relay Satellite System
• THEMIS Time History of Events and Macroscale Interactions during Substorms
• UV Ultraviolet
• VAFB Vandenberg Air Force Base
• VILSPA Villafranca del Castillo Satellite Tracking Station
• VT Variable Time
• WFF Wallops Flight Facility
• WSGT White Sands Ground Terminal
• WW II World War 2

• cm centimeter
• E energy
• H momentum
• I momentum of inertia
• kg kilogram
• km kilometer
• m meter
• ω omega