• Thrust level and thrust direction errors:
These errors can be reduced by particular calibration maneuvers at the beginning of the mission.
• Thrust duration errors:
Duration of thrust depends on the thrust level available and on the boost to be achieved. Errors can be kept very low, when controlled by the clock of the onboard system.
• Start time errors:
Start time of thrusts can be calculated either on board or on ground. In particular the start time of the second boost has to be determined accurately together with the thrust duration to end the trajectory at the desired point. When calculated on ground, time tagged commands will be sent to the spacecraft and executed according to the onboard clock. In both cases time errors can be kept very low.
For impulsive open loop maneuvers, only the thrust level errors will play a major role. The start and stop time can easily be implemented with high accuracy and thrust duration errors are, therefore, much lower in value.
For closed loop trajectories, such as forced motion straight line approaches to the docking port, small thrust level errors will not play a significant role, as position and velocity are controlled.
Safety Design of Onboard Control System
Considering the fault tolerance requirements stated in the section “Safety Requirements for Rendezvous Missions”, the question is: How must the onboard control system be designed to ensure the required level of safety for approach/departure? The onboard control system (in automatic RVD, which is the more comprehensive case and which will be discussed hereafter) consists of the data management system (computers, operation system software (S/W), data busses), the guidance, navigation and control S/W, the mission and vehicle management S/W, the communication system, and the sensors and the actuators. The failure tolerance requirements must be fulfilled by the complete system and consequently also by each of its components.
Generally, the implementation of failure tolerance requirements can be achieved, depending on the nature of the failure, by:
• switching to a redundant single piece of equipment;
• switching to a redundant functional string;
• interruption or abortion of the mission through:
– inhibition of thrust for trajectory control, leaving the vehicle on a safe trajectory (see “Passive Trajectory Safety”, p. 505),
The first option can be used only when a contingency failure of a particular piece of equipment can immediately and positively be identified. If this is not the case, switching to a parallel hot redundant functional string will be the only possible choice to continue the nominal operations without interruption. If no redundancy is left, the last option to safeguard the integrity of the target will be a CAM or, if the approaching vehicle is on a safe trajectory, the inhibition of thrust.
Where failures of a function depend on the particular design of its hardware and/or software – the design may be susceptible to external or internal disturbances, limited lifetime of components or other effects – the switching to a redundant function of the same design may not help. For this type of malfunction, robustness against failures can be increased by switching to functional redundancy, i.e. using a different design/function for the same required output. For this reason, to increase failure tolerance of a complete system, often dissimilar components, whether equipment or software, are used in redundant strings.
The need for functional redundancy could also be given to ensure sufficient failure tolerance in a subsequent part of the mission, e.g. during departure or emergency retreat. In a case where the redundancy level of sensors has been reduced to a single sensor, which is left due to a failure of the first sensor in a previous phase, the vehicle can continue the approach up to coupling. However, if during further approach or during the attached phase or immediately at start of departure a second sensor failure occurred, there would be no sensor left for safe departure. In such case functional redundancy, possibly at lower performance, could be the solution, as shown in the following example.
In some rendezvous vehicles, such as the ATV and HTV, a suite of satellite navigation sensors and optical sensors are used: in the far range, satellite navigation in absolute mode; in the medium range, satellite navigation in relative mode; and in the short range, optical sensors are used. If for whatever reason all optical sensors have failed, the functional redundancy provided by satellite navigation would still allow for safe departure. At separation, the position, attitude and rates are well known without sensors. During departure, the lower performance of satellite navigation can be accepted here as the measurement performance requirements are opening up with increasing range from the target.
The most important issue concerning the onboard system safety is the detection of any malfunction. Since rendezvous operations are dynamic processes, the time to detect failures is limited, when safety shall be ensured, and this time will decrease with decreasing range. The following sections will discuss possible methods of failure detection for system and equipment.
Computer and Data Bus Failures
Computer and data busses form the data management subsystem of a spacecraft, which is the infrastructure for the onboard control of operations. “Computer” here means the hardware and the operating system, in contrast to the application software, which is discussed in the next section. Obviously, a failure of the data management system running the control software can have potentially very severe repercussions on the safety of the rendezvous operations. Accordingly, redundant strings of the data management system must be available and measures have to be taken to detect malfunctions quickly and to switch over to an unaffected computer or complete string of functions. This switch-over must be smooth, which requires that the next computer must start from a context of navigation, guidance and control parameters very close to the ones used up to the switch-over. Thus, a smooth switch-over can be achieved only when the redundant computer has been processing all the time the same information as the one identified to be faulty. As a result, a redundant computer needs to run in parallel, using the same input.
The question now is how to identify the faulty one. Each processor can run self-test algorithms to identify whether computer hardware and operating system are working properly. Such self-tests cannot cover all possible failure modes though. For this reason more comprehensive schemes have to be used that can isolate a faulty string and possibly can identify the failed function. All of these schemes have their advantages and weak points, and none of them can in any conceivable case identify and isolate all malfunctions. However, a very high amount of possible failures can be covered and a high level of confidence in the failure tolerance can be achieved. Out of the many schemes investigated for this purpose, two shall be shortly discussed here, the “computer voting scheme” and the “computer and state limits monitoring scheme”. Both schemes check the overall results of the rendezvous control system and include both the computer with its operating system and the application software. Checks that can be done on the application software alone are described in the following section.
The “voting scheme” (Figure 8.5.1.18) compares the output of at least three computers. If the output of one computer differs and the two others are the same, the computer that differs will be declared faulty and switched off. A cold redundant fourth one (colored grey) is booted, and after run-up the GNC context is transferred to it from the other two. By monitoring the computer output (GNC state vector, status of equipment and function, etc.) not only computer and software, but the complete functional chain including sensors and data busses is checked. Two-failure tolerance is achieved by a total of four strings. When a second failure occurs there are still three running computers to vote, and the faulty one can be switched off. Disadvantages of the voting scheme are that it does not solve the problem of design-inherent malfunctions and it does not identify the faulty function within the chain.
The “computer and limits monitoring scheme” (Figure 8.5.1.19) relies on the principle that an independent agent monitors the proper operation of the computer, of its operating system and control functions implemented in it, and that it further monitors the safety limits of trajectory and attitude, and of linear and angular rates (GNC state vector). To cover design inherent malfunctions, hardware and software of the monitoring chain must be different from the main rendezvous control function. Also, since each hardware and software component of the safety monitoring function can fail, the complete string of the safety monitoring, including the independent sensors and the safety monitoring processor, must be redundant too.
The main rendezvous-control function must have at least two computers running in parallel to keep the context of the GNC state vector and status of functions available, and a third cold redundant one. The safety monitoring function will identify the faulty computer, will switch on the hot redundant second string and boot the cold redundant third one (colored grey), which will take over the context from the residual running one. Should the second string show the same problem, a Collision Avoidance Maneuver (CAM) will be initiated.
To monitor the safety limits of the GNC state vector, the monitoring function must process GNC algorithms similar to those of the main function. They can be simpler and more robust, however, as they do not need to be designed for ultimate performance. If safety limits are reached, the safety monitoring function will initiate a CAM.
Application Software Failures
Application software means here the “rendezvous control software” including the GNC-, the Mission and Vehicle Management (MVM) and failure detection algorithms. The discussion of the failure detection schemes in the previous section has shown that failure monitoring of data management system and application software cannot be separated. But for the detection of malfunctions within the application software, independently of the computer scheme used, monitoring and self-test algorithms can be applied. These self-tests cannot cover all failure modes though, and in particular they cannot ensure in all cases that trajectories, attitudes and rates stay within safe limits. The required fault tolerance can be achieved only in combination with the failure detection schemes discussed above. Self-test algorithms can be applied in the following areas:
Concerning the GNC parameters, the first and most important check is the monitoring of safety limits for trajectory, attitude, linear and angular rates, which are set around the instantaneous nominal values by the guidance function. As discussed above, in the “computer and limits monitoring scheme” (Figure 8.5.1.19), this will also be done independently by the safety monitoring function in a separate computer. Figure 8.5.1.20 shows for a straight line approach the nominal trajectory, the control margins and the safety boundaries in the V-bar/R-bar (in orbit plane) coordinate frame and in range/range–rate frame. When the control margins are reached, a corrective boost will be given, when the safety boundaries are transgressed, a CAM will be initiated.
FIGURE 8.5.1.20 Control and safety limits during V-bar approach. (Fehse, 2003)
In addition to the monitoring of safety boundaries, the observation of particular GNC criteria can provide information whether or not the GNC function works properly. Observables in the navigation function that can identify failures include:
• Discrepancy between the state vector (position, attitude, linear and angular rates) as measured and as propagated by the navigation filter: if this discrepancy exceeds a certain value or extents over a certain time, a failure condition exists.
• Convergence of the navigation filter: if the navigation filter does not converge or takes too long time to converge, a failure condition exists.
• Difference between planned and actual duration of maneuvers: if the actual duration differs from the planned one by more than a certain value, a failure condition exists.
Since the navigation function has many data inputs, i.e. trajectory sensors, attitude sensors, propagated state vector, with such checks only a failure condition can be identified, without being able, however, to point to the failure source.
Observable in the control and thruster management function is, for example, the saturation of the command output to the thruster control unit for a particular torque/force (not applicable during planned large boost maneuvers). If there is outside planned trajectory boost or attitude slew maneuvers a continuous command in one direction, either the actual trajectory/attitude deviates by a large amount from the nominal one, or a large disturbance force acts on the spacecraft (beyond a certain level this can be only a thruster-open failure).
Failures of the MVM software are more difficult to identify on application software level. This can better be detected on ground or on system level, i.e. by the schemes discussed in the previous section.
In all cases where a collision danger is detected or a severe failure condition is identified by the application software, a CAM will be initiated. However, to avoid a CAM when it may not be necessary, the onboard system will notify the ground operators a few seconds before initiation that CAM is imminent. The ground operator has than the possibility to override this decision and to initiate other measures.
Thruster Failures
With respect to the effects on trajectory and attitude control, one can distinguish two types of thruster failures:
• “Thruster-open” failures are cases where the thruster is fully or partially stuck open. “Half-open” thrusters, i.e. stuck open with partial thrust, can be treated as “thruster-open” failures.
• “Thruster-closed” failures are cases where a thruster valve cannot be opened any more.
“Thruster-open” failures are dangerous in principle, as they can lead to any kind of trajectory, including collision trajectories. However, in most cases, the “thruster-open” condition can be detected by an easy criterion, already addressed above: if a thruster fails open, it will produce a disturbance torque, against which the attitude control part of the GNC system will react with a counteracting torque. Therefore, it can be concluded that if the the GNC system commands continuously a torque beyond a certain level in one direction, a “thruster-open” failure must exist.
After detection, “thruster-open” conditions can be resolved by closing valves in the lines leading to that motor. By this action the “thruster-open” failure becomes a “thruster-closed” failure. The failure detection isolation and recovery system (FDIR) and the MVM will then switch over to a redundant thruster.
“Thruster-closed” failures are then in real operations more critical than “thruster-open” failures, because the sole remedy for it is to switch over to a redundant thruster. If after a second failure no thrust capability in a certain direction is left, or if, because of a failure, e.g. in the GNC or the thruster control electronics, any thrust in any one direction has become impossible, the vehicle is not controllable any longer. To avoid collision in such case without a CAM, the vehicle must fly on a “safe” trajectory, as discussed in the section “Passive Trajectory Safety” below.
Sensor Failures
Sensors used during rendezvous operations include radio frequency (RF) sensors and optical sensors for position and velocity measurements, and optical sensors and gyroscopes for attitude angles and angular rate measurements. In contrast to errors in the sensor measurements, the effects of which have been discussed above in the section “Navigation Errors”, sensor failures are malfunctions, where the sensor produces either:
The first types of sensor failure can be detected relatively easily by a built in self-test function of sensor. To a certain extent, this is also possible for the third type of failure, i.e. increased noise, where the built-in test algorithms can check whether the signal to noise ratio is beyond a certain limit.
The check of the second type of failure depends on the measurement principle of the sensor. For optical sensors, it can be checked whether a target pattern has been detected, and a similar test can be made also for radar sensors. For other RF sensors, the reception of the target transponder signal can be checked. For all these “range-direction” sensors it can be checked whether a range and direction measurement is produced. For satellite navigation it can be checked whether the receivers on chaser and target produce individually a navigation solution.
For abnormally high bias, the sensor itself would not have any reference to detect such a failure. Abnormal bias can be detected, however, in the navigation function by comparing the incoming measurement value with the value obtained by propagation of the state vector of the vehicle, as described above in the section “Application Software Failures”.
Generally it is the task of the sensor self-test function to notify the system, whether or not the sensor is healthy. However, in addition the navigation function can also check whether the sensor signal arrives at GNC function in the specified format. With such an easy test, a preliminary check concerning the operation of the sensor can be performed and at the same time proper working of the sensor software can be monitored.
Communication Failures
Since there is no need to perform in an Earth orbit rendezvous operations fully autonomously, most onboard processes are monitored and some are actively controlled by ground. Therefore, in all types of manned or unmanned rendezvous missions in an Earth orbit, communication between each of the two vehicles and its respective ground control center is required for monitoring and supervising high level control. For this purpose, the spacecraft continuously send data to ground concerning their GNC state vector and vehicle status. For data sent to the vehicle from ground, the spacecraft has to send back an acknowledge signal. In this way proper functioning of the links in both directions can be checked. In addition, during the rendezvous phase proper, communication on ground between the two ground control centers is required.
Space–ground links cannot be made fully redundant. There are not sufficient frequencies available to have redundant transmission on different frequencies, and also communication lines on ground, which are often commercial lines, are usually not redundant. Link interruptions of undefined duration can be caused by any element in the chain. For this reason, it is important in manned missions that the crew of the manned vehicle can monitor the state of the other vehicle, and that in the case of major contingencies it is able to command a retreat or a CAM. It is essential that during the rendezvous operations communication exist between the two vehicles and that the crew in the manned vehicle can perform a check of the communication links in both directions between chaser and target. This can be done, for example, by sending in short intervals a test signal, which has to be sent back by the other vehicle.
Where satellite navigation is used in relative mode, communication between chaser and target is also important for navigation. If, for example, satellite navigation data are transmitted from the target to the chaser and GNC data are transmitted from chaser to target for monitoring, the crew will implicitly check the links in both directions.
Collision Protection
Passive Trajectory Safety
Failure detection and other safety measures described above can provide a high degree of safety for the approach up to capture. However, they cannot protect 100% against all failures. Despite all failure-tolerant design of onboard system and functions, there are failure modes that can leave the vehicle uncontrollable, e.g. in the case of catastrophic failures, such as complete failure of the rendezvous control system, including computer, data busses or software, e.g. due to explosion on board or due to collision with meteorite or space debris. In such cases the propulsion system will be inhibited. It is then important that the approach strategy is designed in such a way that the chaser remains as long as possible on a passively safe trajectory. Passively safe is a trajectory that will not lead to collision with the target when all propulsion is inhibited.
Obviously, in a rendezvous mission not all trajectory elements can be fully passively safe. Docking, for example, is a controlled collision, and the trajectory leading to docking cannot be fully collision free. But also trajectory elements of the approach scheme prior to the final approach will, if certain failure modes occur, not be fully collision free. Figures 8.5.1.21–8.5.1.24 show the trajectory safety characteristics of four types of trajectory elements (undisturbed trajectory evolution).
FIGURE 8.5.1.21 Passive safety: Hohmann-transfer. (Fehse, 2003)
FIGURE 8.5.1.22 Passive safety: Vx-transfer. (Fehse, 2003)
FIGURE 8.5.1.23 Passive safety: Vz-transfer. (Fehse, 2003)
FIGURE 8.5.1.24 Passive safety: straight line transfer. (Fehse, 2003)
Figure 8.5.1.21 shows the trajectory evolution in a Hohmann transfer (start and stop boosts in orbit direction) for thrust inhibits at four different points in time:
(a) The first boost of the transfer cannot be given at all
– the trajectory continues on the lower orbit as before point 1
(b) The second boost of the transfer cannot be given at all
– point 2 can be chosen such that the trajectory will loop safely under the target
(c) The first boost is inhibited prior to completion
– the trajectory will loop safely under the target, since its apogee will be below the target orbit
(d) The second boost is inhibited prior to completion
– the apogee of the trajectory will be always on the target orbit
Figure 8.5.1.22 shows the trajectory evolution in a tangential boost transfer along V-bar (start boost in, stop boost against orbit direction) for thrust inhibits at four different points in time. The trajectory evolution is similar to that of a Hohmann-transfer, however, since the trajectory starts and stops on the target orbit, thrust inhibits prior to completion at both the start and the stop boost, i.e. cases (b) and (c) can lead to collision!
Figure 8.5.1.23 shows the trajectory evolution of a radial boost trajectory (start and stop boosts in radial direction) for thrust inhibits at four different points in time:
(a) The first boost of the transfer cannot be given at all
– since the vehicle is on the target orbit, with no boost it will stay at that point
(b) The second boost of the transfer cannot be given at all
– the trajectory will continue its elliptic shape through the starting point, if not stopped
(c) The first boost is inhibited prior to completion
– the trajectory will perform a smaller ellipse continuing through the starting point, if not stopped
(d) The second boost is inhibited prior to completion
– the trajectory will perform a smaller ellipse continuing through the target point, if not stopped
This safety behavior of the undisturbed radial boost transfer makes it particularly useful for rendezvous approaches along V-bar in the vicinity of the target (over longer time, disturbances may to collision danger).
During the last part of the approach (100–300 m), the chaser will move on a straight line, usually along V-bar or R-bar, in order to meet the docking axis of the target. The trajectory evolution after thrust inhibit during a straight line approach on V-bar is shown in Figure 8.5.1.24. The size of the trajectory after thrust inhibit depends on the approach velocity. By reducing the approach velocity with decreasing range to the docking port, the approach can be kept safe over a certain range. Due to the structural extension of chaser and target and due to the fact that docking has to be performed at a certain minimum velocity, trajectory safety will from a certain point down to docking no longer be possible though.
Note: These considerations on passive trajectory safety are valid in LEO only. Due to the fact that in GEO the direction of the disturbance force due to solar pressure rotates by 360 deg per orbit, no passive trajectory safety can be achieved in GEO (Fehse, 2010).
Active Collision Protection
When sufficient margins are observed, it is possible, where existing, to rely in LEO for a certain time on trajectory safety. However, failures of the onboard system can occur (see section on “Safety Design” above) and, as Figure 8.5.1.7 shows, orbital disturbances such as drag can over longer time also make a safe trajectory unsafe. For this reason a suitable CAM must be available for all rendezvous phases. The CAM must be a simple boost of a fixed magnitude, which, if necessary by a combination of thrusters, will produce the required thrust direction and magnitude to move the chaser away from the target. Since it may be difficult to change the position of the target in a short time, there may be a requirement that the CAM-boost is strong enough that the chaser will not return to the vicinity of the target within a particular time, depending on the maneuvering capabilities of the target (24 h in case of the ISS).
During the final approach, both the control centers of chaser and target must have the possibility to request a CAM, and in manned missions, crew in either chaser or target must be able to immediately initiate a CAM in case of contingency situations (see safety control responsibilities shown in, Figure 8.5.1.25).
FIGURE 8.5.1.25 Safety responsibilities during final approach. (Fehse, 2003)
Note: In contrast to LEO, in GEO a single boost CAM will not provide sufficient protection against collision, as the trajectory developments in the section on “External Disturbances” show. To achieve a safe trajectory after a first CAM boost a second boost has to be applied half an orbit (12 h) a safe trajectory after the first one. Fortunately, trajectory development in GEO is slow. This will make it possible to calculate and command adequate escape maneuvers from ground (Fehse, 2010). Only for the last tens of meters of approach to contact automatic collision danger detection and CAM command for the first boost must be available on board.
At a distance of a few meters between the docking interfaces of chaser and target, depending on the approach velocity, the thrust level of the thrusters available for a CAM will not be sufficient to stop and reverse the vehicle prior to contact with the target. Also, the plume of these thrusters will fire towards the surface of the target vehicle, which at very close distance may be harmful. For this reason, there will be a decision point in the final part of the approach, beyond which no CAM can be initiated.
Conclusions
Rendezvous and docking (RVD) of two spacecraft is based on the precise control of their relative position, velocities, attitude and angular rates. If during the approach these parameters are outside of very narrow bands, success of rendezvous and capture would become uncertain and the integrity of the two vehicles could be endangered. In manned missions this would put the life of the crew at risk. In unmanned missions the investment made in the space segment would be endangered.
RVD includes a large number of complex and interacting systems in space and on ground, the uninterrupted function of which must be maintained during the rendezvous process. These systems include the two rendezvous vehicles, relay and navigation satellites, antenna ground stations, ground communication links and the control centers for chaser and target.
With the multitude of systems involved, the achievement of safety during the rendezvous process is a challenging task. It requires protection against orbital disturbances, against errors of sensors and thrusters, against failures of the onboard system and its functions, and against failures of the in-orbit communication links between the two vehicles and the space/ground links between each of the spacecraft and their respective ground control center.
Since no protection scheme can cover 100% of all combinations of possible failures, the approach strategy will use to the maximum extent possible short-term collision-free trajectories. The ultimate means to ensure safety will be active monitoring of position and velocity boundaries and, when necessary, the execution of a Collision Avoidance Maneuver (CAM).
Acknowledgment
Figures 8.5.1.1, 8.5.1.6, 8.5.1.7, 8.5.1.20, 8.5.1.21, 8.5.1.22, 8.5.1.23, 8.5.1.24 and 8.5.1.25 were prepared by the author for a previous publication (Fehse, 2003) and are reproduced here by courtesy of Cambridge University Press.
Literature
References
1. Apollo program. In: Wikipedia, The Free Encyclopedia. 2013; Retrieved February 10, 2011, from http://en.wikipedia.org/wiki/Apollo_program; 2013.
2. Apollo–Soyuz Test Project. In: Wikipedia, The Free Encyclopedia. 2011; Retrieved February 2013, from http://en.wikipedia.org/wiki/Apollo-Soyuz_Test_Project; 2011.
3. Cornier D, et al. The Automated Transfer Vehicle (ATV) Mission to the International Space Station (ISS). Houston, Texas: Procedings of the AIAA International Space Station Service Vehicle Conference; 1999.
4. Doornbos E, et al. Air density models derived from multi-satellite drag observations. Potsdam, Germany: Second ESA SWARM international science meeting; 24–26 June, 2009.
5. Fehse W. Automated Rendezvous and Docking. ISBN 0 521 82492 3 Cambridge University Press 2003.
6. Fehse W. Tutorial Lectures on LEO & GEO Rendezvous. Handout of charts (Revision Jan. 2006), ESA internal, unpublished 2006.
7. Fehse W. Disturbance of Rendezvous Trajectories in Geostationary Orbit by Solar Pressure. 2010; Working paper for ESA (Draft), internal, unpublished.
8. Fehse W. Disturbance of Rendezvous Trajectories in Geostationary Orbit by Solar Pressure. Noordwijk, The Netherlands: 5th International Conference on Astrodynamics Tools and Techniques; 2012.
9. International Space Station. In: Wikipedia, The Free Encyclopedia. 2013; Retrieved February 2013, from http://en.wikipedia.org/wiki/International_Space_Station; 2013.
10. Kaiser C, et al. Simulation of the Docking Phase for the SMART-OLEV Satellite Servicing Mission. Hollywood, USA: International Symposium on Artificial Intelligence, Robotics and Automation in Space (i-SAIRAS); 2008.
11. Kawano I, et al. First results of autonomous rendezvous docking technology experiments on NASDA’s ETS-VII satellite. Melbourne: 49th International Astronautical Congress; 1998.
12. Kawasaki O, et al. The on-orbit demonstration and operations plan of the H-2 Transfer Vehicle (HTV). Rio de Janeiro: IAF 51st International Astronautical Congress; 2000.
13. Mulder T. Orbital Express Autonomous Rendezvous and Capture Flight Operations. In: Proceedings of the AAS/AIAA Space Flight Mechanics Meeting, paper AAS 08-209. 2008; Galveston: Texas.
14. NASA. System Specification for the International Space Station. NASA JSC, Houston: SSP 4100, International Space Station Program; 1998.
15. NASA NESC. Demonstration of Autonomous Rendezvous Technology, Mishap Review Board. NASA Engineering and Safety Center Report RP-06-119 2006.
16. Project Gemini. In: Wikipedia, The Free Encyclopedia. 2013; Retrieved February 2013, from http://en.wikipedia.org/wiki/Project_Gemini; 2013.
17. Siddiqi AA. Challenge to Apollo. NASA History Division, Washington DC: NASA SP 2000-4408; 2000.
18. Soviet space program. In: Wikipedia, The Free Encyclopedia. 2013; Retrieved February 10, 2011, from http://en.wikipedia.org/wiki/Soviet_space_program; 2013.
19. Wingo DR. Orbital Recovery’s Responsive Commercial Space Tug for Live Extension Missions. AIAAA-RS2 2004-3004 Los Angeles, CA: 2nd Responsive Space Conference; 2004.
Useful literature on safety in rendezvous operations
1. Cornier D, et al. Automated Transfer Vehicle Proximity Flight Safety Overview. Nice: 1st IASSS conference; 2005.
2. Cavrois B, et al. ATV Flight Control Monitoring: A Dedicated ATV Function to Ensure the Safety of the ISS during Rendezvous. Nice: 1st IASSS conference; 2005.
3. Mongrard O, et al. ATV On-Board Flight Control Monitoring Design and Trajectories Safety Assessment. Nice 2005: 1st IASSS conference; 2005.
4. Strandmoe S, et al. Automated Transfer Vehicle (ATV) Flight Control Achievements. Tralee, Ireland: 7th International ESA Conference on Guidance, Navigation & Control Systems; 2008.
5. Ludwig K, Zekri E, Devic M-O. Automated Transfer Vehicle (ATV) Mission and Safety Critical Software Development. Rome: 3rd IAASS Conference; 2008.
6. Fehse W. Close Proximity Rendezvous and Docking (RVD). In: Blockley R, Shyy W, eds. Encycopedia of aerospace engineering. Chichester, UK: John Wiley & Sons Ltd; 2010;3271–3288.
8.5.2 Risk Management of Jettisoned Objects in LEO
John B. Bacon and Charles Gray
The construction and maintenance of the International Space Station (ISS) has led to the release of many objects into its orbital plane, usually during the course of an extra-vehicular activity (EVA). Such releases are often unintentional, but in a growing number of cases the jettison has been intentional, conducted after a careful assessment of the net risk to the partnership and to other objects in space. Since its launch in 1998 the ISS has contributed over 80 trackable objects: on average at least one additional debris object that is simultaneously in orbit with the station, although the number varies widely from zero to eight at any one moment. Although (owing to the very low altitude of the ISS) these objects have generally decayed within weeks to months, all of these objects present potential risks to other objects in orbit.
Whether it comes from known and tracked orbiting objects or from unknown or untrackable objects, collision with orbital debris can have disastrous consequences. Objects greater than 10 cm are generally well documented and tracked, allowing orbiting spacecraft or satellites opportunities to perform evasive maneuvers (commonly known as Debris Avoidance Maneuvers or DAMs) whenever imminent collision is predicted. The issue with smaller debris, however, is that it is too numerous to be tracked effectively and yet still poses disastrous consequences if it intercepts a larger object. Due to the immense kinetic energy of any item in orbit, collision with debris as small as 1 cm can have catastrophic consequences for many orbiting satellites or spacecraft.
Faced with the growing orbital debris threat and the potentially catastrophic consequences of a collision-generated debris shower originating in an orbit crossing the ISS altitude band, in 2007 the ISS program manger asked program specialists to coordinate a multilateral jettison policy amongst the ISS partners. This policy would define the acceptable risk trade rationale for intentional release of a debris object, and other mandatory constraints on such jettisons to minimize the residual risks whenever a jettison was accepted. Although by retaining ISS-related debris there are incumbent potential risks to the EVA crew, the intra-vehicular activity (IVA) crew, and/or to a departing cargo vehicle for a controlled disposal, the release of such objects to a slow natural decay also presents a ballistic nuisance to the visiting vehicle traffic, and a potential fragmentation threat to the hundreds of other functional and debris objects whose perigees lie below the ISS orbital altitude. Thus, every such jettison decision is a conscious risk trade.
After more than three years of refinement and negotiation, the Multinational Partner Program Directive (PPD) #1101 was signed March 8 2010 in Japan, binding the six partner agencies (ASI, CSA, ESA, JAXA, NASA, & RSA) to an analytical process and risk trade criteria that guide the decision-making in every such intentional jettison. The decision to jettison an object is not taken lightly, as it adds measurable risk with high potential consequences to all partners, and indeed, all space-faring nations. For that reason, the decision to jettison each candidate object is one of the only detailed procedural steps decided at the highest management level of the program. The Space Station Control Board, whose membership is comprised of the top program manager of every partner agency, must approve every intentional jettison by any partner. No single low-level procedural step routinely gets as much senior management scrutiny as the jettison decision receives in this measured risk trade.
The ISS jettison policy recognizes and supports all recommendations of United Nations Committee On the Peaceful Uses of Outer Space (UNCOPUOS) Space Debris Mitigation Guidelines (June 2007), to which all ISS partner agencies are signatories. (Ref: Annex pg 47 at www.unoosa.org/pdf/gadocs/A_62_20E.pdf.) However, the UN guidelines are necessarily high-level, and must be interpreted at a tactical level with more measurable constraints and requirements. Such detailed risk trade criteria and standard practices are reflected in the policy letter, which establish the agreed standard procedures and criteria for analyzing and accepting the risks associated with jettison. With six agencies all committed to this set of standard criteria, the ISS jettison policy serves as a broad international consensus of the detailed risk trade process and criteria to be applied when assessing whether a new orbital debris object is acceptable.
The ISS partnership recognizes that several conditions merit the discussion of intentional jettison as part of a larger risk assessment. These candidates for jettison, as defined in the directive, are as follows:
1. Items that pose a safety issue for the ISS or for return onboard a visiting vehicle (contamination, materials degradation, etc.).
2. Items that negatively impact ISS utilization, return or on-orbit stowage manifests.
3. Items that represent an extra-vehicular activity (EVA) timeline savings large enough to reduce the sum of the risks of EVA exposure time and the orbital environment’s hazardous debris population, compared to the sum of such risks without a jettison.
Category 1 items have included materials soaked with highly toxic, partially-combusted propellants, degraded/abraded fibreglass blankets (asbestosis risk), and other materials. Category 2 items have arisen when dedicated flight service equipment to hold the object during a controlled deorbit would otherwise displace necessary upmass on a visiting vehicle. (This was the case of the large Early Ammonia Servicer (EAS) in 2007 [see Figure 8.5.2.1]. Other situations arise when chronically-full interior volumes cannot be stuffed further, and the interior clutter becomes untenable.) Because EVA is inherently risky, a probabilistic risk assessment is performed in category 3 to weigh the risks to the crew if significant extra time must be allocated to temporarily stow and then transport cumbersome material to the airlock. This trade varies by EVA location and task length. Category 4 includes many proposed small satellites, some of which are expected to be deployed by mechanical means.
FIGURE 8.5.2.1 Astronaut Clay Anderson jettisoning the Early Ammonia System (EAS) from the ISS. Photo credit: NASA.
Every time a jettison is authorized, the policy enforces several steps to minimize the residual risks that are to be accepted. These accepted risks occur in four distinct timeframes that begin at the moment of jettison. These timeframes and associated risks are as follows:
1. Initial trajectory away from the release point (measured in seconds).
(a) A collision risk occurs at the edge of a “keep out” cone whose axis is the intended jettison velocity vector. Controllability and judgment issues could cause the outbound object to collide with ISS structure, so this jettison cone has mandatory minimum clearance conditions.
2. First-orbit curving relative motion that might lead to contact with ISS structure (measured in minutes).
(a) As all separating objects in orbit follow complicated relative motion (obeying the Clohessy–Wiltshire solutions to Hill’s equations), it is important to account for potential interferences with the ISS’s large extensions into all three orthogonal axes, and to achieve adequate separation throughout the first orbit. The jettison cone therefore has directional conditions relative to the V-bar and ISS attitude, whose initial conditions are known to provide adequate clearance along Clohessy–Wiltshire curves. By the end of the first orbit, the ISS partners require >200 m clearance from the ISS centre of gravity.
3. The natural decay of the object (measured in days or weeks).
(a) A collision of the jettisoned object with any crossing piece of debris could lead to a cascade of lethal finer debris in the path of the ISS (and of all other spacecraft that have perigees below the apogee of the intercepting object). Fragmentation of the jettisoned object by any means is cause for concern in this time period. Generally, the most likely cause of fragmentation is the release of stored energy in a collision with an untracked small debris particle, but thermal and other failures are considered. Further, the jettisoned object joins the catalogue of tracked objects that provide potential operations overhead to all ISS visiting vehicles. If the object is of very high ballistic number, it has the potential to revisit the ISS itself, but generally it is the visiting vehicle fleet and other spacecraft that are most probably affected by ISS jettisoned objects.
4. The final re-entry of the jettisoned object through the atmosphere (measured in minutes).
(a) Surviving fragments of the object pose a risk of injury to the ground population.
Initial clearance of all ISS/visiting vehicle structures is accomplished by ensuring that the planned velocity vector of the jettisoned object is the axis of an unobstructed cone of a 30° half-angle (minimum), and that the object is within acceptable EVA control (i.e., “handle-able”) as characterized by the responsible EVA Office. The desired cone axis is defined to the EVA crew in relation to readily identifiable landmarks such as structure or the horizon, and the jettison process is a required training step.
The jettisoned object is required to clear a 200 m radius keep-out sphere (centered around the ISS c.g.) within one orbit, and maintain positive clearance during the first orbit at all times. This is accomplished by assuring sufficient velocity component in the –V-bar direction from anywhere within the allowed jettison cone.
During any single revolution following the second orbit after the jettison, while the altitude of the object is within 5 km of the altitude of the ISS, the jettisoned object shall not decrease its total range from ISS to less than 50% of the minimum total range that occurs during the previous revolution. See Figure 8.5.2.2.
FIGURE 8.5.2.2 Analyzed EVA crew viewpoints from a potential jettison location along jettison corridor. To allow a safe jettison, clearance requirements led to a constraint to lock the position of US solar arrays in a specific location and to manage reduced power. Although the cone axis is substantially below the earth horizon, and thus has a significant radial component, its aft velocity component was analyzed in advance to be large enough to assure safe departure and permanent separation from ISS. Image Credit: NASA.
The relative velocity applied to the jettisoned object is generally the maximum possible within operational constraints and crew capability. However, an object must not require more than 0.05 m/s total delta V to meet recontact keep-out zone criteria. This is to ensure an adequate safety margin in the event of crew error. See Figure 8.5.2.3.
FIGURE 8.5.2.3 Relative motion plots at various points within a jettison cone for one candidate jettison from ISS. Image Credit: NASA.
To be considered, the object’s owner/creator must show a less than 1:10,000 risk of human injury to the ground population avert a random re-entry. Computer assisted design (CAD) models and other relevant data are fed to NASA’s Object Re-entry Survival Analysis Tool (ORSAT) as a required analytical step to prove that this threshold is not exceeded. The ORSAT tool predicts an object’s likely re-entry path, including altitude of break-up and projected risk to the Earth population based on surviving objects impacting the ground. Any waivers to accept violations of this threshold must be endorsed by the highest authority in any jettisoning agency before the Space Station Control Board will consider the jettison. The policy encourages the bundling of candidate items if more than one is to be jettisoned during an EVA or across several coupled EVAs, as is the case with the nine EVAs to externally configure the Russian Multipurpose Laboratory Module (MLM). During this intense EVA activity, candidate jettison items are to be temporarily stowed and connected together into a single jettison bundle on the last EVA, decreasing overall mass/area ratio and minimizing the net collision probability over a the probability of collision resulting from a dispersion of smaller pieces.
Bundling together of multiple candidate jettison items (often utilizing wire ties or other available EVA materials) is also occasionally necessary to assure that the jettisoned item is trackable by the US Space Surveillance Network, which feeds the necessary data to the Joint Space Operations Center (JSPOC), which in turn issues potential conjunction warnings to all operational spacecraft whenever a conjunction is forecast. This trackability requirement is strictly enforced. Although the lower limit of the trackable radar cross section is classified, the ISS partners have reached agreement (with concurrence of the knowledgeable specialists) that a minimum of 100 cm2 of metal or metal foil shall be included in every jettisoned item, or that the radar cross-section shall be equivalent or greater than this. Sometimes this minimum can only be achieved if the item (say a fibreglass ring) is bundled with another, trackable item. This was the case in the outfitting of the second Russian Mini Research Module (MRM2), where four multi-layer insulation blankets (containing many hundreds of cm2 of foil) and two otherwise untrackable fibreglass fixtures were collected into two loose, trackable bundles. See Figure 8.5.2.4.
FIGURE 8.5.2.4 Jettison candidate bundle of three items for Russian EVA 29 on ISS. The fabric panel is not trackable by itself, but may be jettisoned in combination with the aluminum shell pieces. All items are bundled with a single additional copper wire tie. As a single item (vs. three), the net risk to other orbiting objects is substantially reduced. Image Credit: RSC-Energia Corporation.
Additionally, the date of a jettison is planned to assure that the object is catalogued and tracked in enough time to guarantee that its future position is knowable before any visiting vehicle traffic is in the vicinity. Because the ISS itself has such a large radar signature, it nominally takes more than a day before a separated small object can be clearly distinguished from the ISS signal. The general path of a jettisoned object downwards and forward of the ISS means that jettisoned objects are mostly a concern for departing vehicles, which follow the same general corridor.
The partners enforce the UNCOPUOS guideline that a jettisoned object must not fragment before it decays into the atmosphere. The fragmentation potential is always expressed as a probability. The multilateral policy has adopted the NASA internal requirement that the jettisoned object must have a probability of fragmentation less than 1:10,000. The ability of an object to meet this criterion is dependent upon the nature of any stored energy, the susceptibility and vulnerable fraction of the object to micrometeoroid and orbital debris (MMOD) particles or to thermal issues, and the expected time to decay.
Since the policy’s development, many interesting challenges and policy subtleties have emerged, some of which are still under debate. For example: does the policy affect ISS visiting vehicles that deploy equipment or sub-satellites below the orbital altitude of the ISS? Does it affect visiting vehicle operations above the ISS altitude? Does the partnership need to pre-approve every item that might need to be discarded if its flight service/attachment equipment fails and cannot accommodate the object in a nominally planned controlled re-entry? If a cube-sat launcher is approved, does every cube-sat need to be individually approved by the partnership, and must each of these cube-sats be individually analyzed against all policy requirements? How should the program treat requests for constellations of jettisons, such as proposals for cube-sat wide-area sampling of the mesosphere, or other constellations? Are there restrictions to be enforced on fluid venting?
In the case of the last question, it is known that the lifetime of particles in LEO is only a few days at most, but there is a wide range of possible location of the edges of the dispersed particle “cloud” as the particles decay. This variability results from wide variance in initial conditions and the uncertainty in sublimation physics (and thus ballistic number) in a cloud of vented particles. Fortunately, within the orbital plane, the relative velocity at intercept with an orbiting visiting vehicle is subsonic, and thus not a fragmentation concern, although minor damage and contamination is still possible. NASA has developed a Sublimating Particle Orbit Calculator (SPOC) that can assess the boundaries and population densities in orbiting plumes of water (and other sprays) relative to other objects in the same orbit plane. This tool has been used on occasion to confirm that the plume from a planned venting will miss active visiting vehicles orbiting below the ISS, and occasionally to bound the maximum particle fluence. Although impossible to certify with current measurement capability, extensive analysis and data have been incorporated in the tool to account for high drag, varying ballistic number particles (whose sublimation rate varies with orbital lighting), and a varying atmospheric density. Such analyses provide a precise model of particle propagation in orbit, accurate to best understanding of the freezing and sublimation process of the particles: an understanding that still has several unknowns. These unknowns are bounded in a range of possible particle sublimation models propagated by the tool. NASA has used this tool on several occasions to clear operational zones for other spacecraft when Shuttle or ISS have conducted vents.
Productive space operations will forever be performed in the presence of significant risk from orbital debris. The six partner agencies in world’s most visible spacecraft – the International Space Station – have collectively addressed their responsibility to manage the risk in a globally optimized, responsible way. They continue to develop tools, analyses, and processes to minimize the risk for all space-faring nations.
8.6 Spacecraft Charging Hazards
Steven L. Koontz, Leonard Kramer, Ronald R. Mikatarian and Carlos E. Soares
General Concepts
Spacecraft Charging Environments and Charging Mechanisms
Space flight environments and space plasma
Plasma is defined as an electrically conductive ionized gas (Smirnov, 2001; Lieberman and Lichtenberg, 1994). Spacecraft flight environments, far from being simple thermal vacuums, are characterized both by a wide range of space plasma conditions and by ionizing radiation, magnetic fields, micrometeoroids, orbital debris, and other environmental factors, all of which can affect spacecraft performance (Hastings & Garrett, 1996; Whipple, 1981).
Spacecraft charging environments, processes and effects
Spacecraft charging refers both to the effects of physical processes that produce an electrical potential or voltage difference between the spacecraft conducting structure and the surrounding space plasma environment, as in absolute charging, and to the effects of processes that produce voltage differences between electrically isolated parts of the spacecraft, as in differential charging (Hastings & Garrett, 1996; Whipple, 1981). Subject electrical potential differences result from the separation of positive and negative charges, either in the spacecraft or in the flight environment, followed by accumulation of an excess of one charge on a spacecraft or spacecraft component. This accumulation of charge on spacecraft or spacecraft components is described and quantified using current balance equations that account for the ion and electron currents to and from the spacecraft (Garrett & Whittlesey, 2000; Hastings, 1995). The flux and kinetic energy of high-energy (>100 keV) charged particles, local space plasma density and temperature, spacecraft motion relative to the local space plasma, and spacecraft or spacecraft system operating voltages can all affect the spacecraft charging current balance (Garrett & Whittlesey, 2000; Hastings, 1995). Charged-particle kinetic energy can be expressed in electron volts, so the voltage driving a charged particle current in a charging circuit model is the same as the charged-particle kinetic energy expressed in electron volts (Smirnov, 2001; Lieberman & Lichtenberg, 1994).
Processes driving spacecraft charging include: active or passive collection of low-energy charged particles from the spacecraft plasma operating environment; passive collection of energetic charged particles; and ejection of charged particles from spacecraft surfaces by impingement of solar ultraviolet photons, solar extreme ultraviolet photons, and energetic charged particles (Garrett & Whittlesey, 2000; Hastings, 1995). Motion of the spacecraft with respect to the plasma reference frame is also important, particularly in relatively cold, dense ionospheric plasmas in which the forward (ram)-facing spacecraft surfaces are exposed to a very different plasma environment than that to which the aft (wake)-facing spacecraft surfaces are exposed whenever the plasma temperature (i.e., the average gas kinetic speed of the plasma ions and/or electrons) is comparable to or smaller than the spacecraft velocity (Engwall, 2004; Samir et al., 1987). Motion relative to the geomagnetic field induces a voltage drop across the dimension of a spacecraft mutually orthogonal to the vehicle velocity and the local magnetic field. The induced voltage moderates charge collection at conducting surfaces.
Plasma temperature and density determine the plasma Debye length, λ, which, in turn, determines the spacecraft plasma interaction character (Smirnov, 2001; Lieberman & Lichtenberg, 1994; Hastings & Garrett, 1996; Whipple, 1981). Plasma is a conducting gas that, like a metallic conductor, responds to the electrostatic field of a charged object by redistribution of charges so as to cancel the subject electrostatic field at distances from the charged object that are greater than λ. Equations (1) and (2) give an approximate expression for the potential as a function of distance, r, from a small spherical object of radius, R, with a negative potential, Vs, moving rapidly through a plasma (Whipple, 1981):
(1)
(2)
The capacitance of the body in the plasma can then be obtained from the ratio of the charge on the body to its potential. This is given by eq. (3), which shows that effective spacecraft capacitance can be strongly dependent on λ and, therefore, on space plasma density and temperature:
(3)
Spacecraft charging is often harmless, but it can lead to operational anomalies and even loss of the spacecraft, depending on the severity of the charging environment and how the subject environment interacts with the spacecraft systems (Cho et al., 2006; Fennel et al., 2001; Dorman, et al., 2005). Spacecraft charging processes include internal or deep dielectric charging, surface charging, and absolute charging of spacecraft conducting structure (Hastings & Garrett, 1996; Whipple, 1981; Garrett & Whittlesey, 2000; Hastings, 1995). Absolute charging is generally not detrimental to the spacecraft, although some science data have been lost as a result of it (Katz, Davis & Snyder, 1998; Brace, 1998). The capacitance represented in eq. (3) may be significantly greater when the body is covered by thin dielectric as for example in the case of chemically treated anodized aluminum. Absolute charging in these cases, which are discussed in the later section on “Spacecraft Configuration and Flight Environment Effects” (p. 524), can lead to destructive dielectric breakdown arcing if the magnitude of frame voltage creates a high electric field across the dielectric coatings, as explained in the section on “Spacecraft Charging – International Space Station Lessons Learned” (p. 535). Discharge arcing between differentially charged surfaces is responsible for the most important detrimental effects, e.g., materials property degradation, conducted and radiated electromagnetic interference effects that can disrupt or damage spacecraft electronics, and even the destruction of spacecraft electrical system components (Cho et al., 2006; Fennel et al., 2001; Dorman et al., 2005).
Lunar, asteroid, and gas giant moon surface asset charging environments
Spacecraft charging processes are also operative on the surfaces of solar system bodies with atmospheres so tenuous that space plasma and energetic charged particles can reach the surface, such as the Moon (Stubbs et al., 2007; Halekas, Lin & Mitchell, 2005; Halekas et al., 2007). Measurements made by spacecraft confirm the dielectric lunar surface can, under some circumstances, exhibit both absolute and differential charging to many kilovolts (Garrett & Hoffman, 2000). Similar charging environments should be expected on the surface of Mercury, asteroids, the martian moons, and the moons of gas giants that have little or no atmosphere. While uniform charging of the surface of a solar system object presents no clear threat in itself, the observed charging events point to the existence of potentially hazardous spacecraft charging environments that should be taken into account in surface asset design, verification, and operations planning.
Typical spacecraft floating potential values
Table 8.6.1 summarizes the equilibrium or steady-state floating potential – i.e., the electrical potential difference between the spacecraft and the local plasma – of a simple (no internal voltage/current sources), small (<10 m diameter), metallic sphere spacecraft in various quiescent (no geomagnetic storms or solar particle events) space plasma flight environments (Whipple, 1981). In disturbed space environment conditions, such as solar particle events or magnetic storms in planetary magnetospheres, charging voltages on the order of kilovolts are often observed, and both differential surface and deep dielectric charging/discharging events can cause anomalies on real spacecraft.
Internal, deep dielectric, or radiation charging
Internal or deep dielectric charging is caused by high-energy electrons and protons (kinetic energy >100 keV) – such as are found in tapped radiation belts near Earth, Jupiter, and Saturn – and in solar particle events and coronal mass ejections (Garrett & Hoffman, 2000; Ryden et al., 2008). Very high-energy trapped electrons or protons can penetrate spacecraft structure and come to rest in the internal dielectric materials of the spacecraft, leading to electrical system anomalies (Evans & Garrett, 2002; Leung et al., 1986; Lai, 2001; Li et al., 2005; Wu et al., 2000).
Internal charging can affect insulators such as cable wrap, wire insulation, circuit boards, electrical connectors, potting compounds, insulators in feedthroughs, and microelectronic device packaging materials. The likelihood of discharge is a function of both electric potential and electric field. The current density to the dielectric, J, is obtained from the penetrating electron flux, 
, as given by eq. (4):
(4)
where q = 1.6022 × 10–19 C/e. The electric field buildup may be estimated from the dielectric conductivity and relaxation time of the material if a simple capacitor plate behavior is assumed:
(5)
where σ is the conductivity of the dielectric, τ is the dielectric relaxation time, and d is the thickness of the material. This electric field (or the maximum field of J/σ) may be compared to the breakdown strength of the dielectric to determine whether or not arcing is likely to occur.
Typically, if 1010 to 1011 electrons/cm2 can become trapped in a dielectric material in a time frame that is small compared to the characteristic dielectric relaxation and charge leakage times, then destructive dielectric breakdown arcing is possible for typical spacecraft materials.
Using data obtained from the Combined Release and Radiation Effects Satellite (CRRES) at geosynchronous altitude, it has been shown that most observed environmentally induced spacecraft anomalies most likely result from deep dielectric charging and the resulting discharge pulses, not from surface insulator charging or ionizing radiation-induced single-event upsets (Gussenhoven, Mullen & Brautigam, 1996).
No hard and fast distinction between surface and deep dielectric charging can be made given the wide range of material properties and electron or proton kinetic energies involved. However, a distinction may be made between them, based on the effectiveness of thin conductive surface coatings as mitigations. Although surface charging can be managed with such coatings, deep dielectric charging cannot be managed due to the depth of electron burial in the material.
Surface charging
Surface charging is produced by the interaction of a spacecraft with relatively low-energy plasma and photoelectron currents (<100 keV). If the plasma environment is dense and cold enough, such as is found in the F2 region of Earth’s ionosphere, surface charging is suppressed by the ionosphere itself, which serves as a gaseous conductor that neutralizes any surface charge accumulations (Smirnov, 2001; Lieberman & Lichtenberg, 1994; Hastings & Garrett, 1996; Whipple, 1981). Surface charging is more important in the 800-km polar Earth orbit and in geosynchronous orbit where the space plasma density is lower, temperature is higher, and kilo electron volt electrons are more abundant, especially in association with geomagnetic storms (Eriksson & Wahlund, 2006). Spacecraft in the 800-km polar or geosynchronous orbit can charge to tens of kilovolts while in eclipse and arc on emerging into sunlight. Photoelectron ejection in sunlight leads to voltages on illuminated parts of the satellite that are a few volts positive, while the shadowed parts, which remain at kilovolts negative and are arcing between adjacent electrically isolated surfaces at very different voltages, is enabled (Anderson, 2001).
Spacecraft system-driven charging
The interaction of specific spacecraft systems that can act as current and voltage sources – e.g., ion engines, electron guns, plasma contactors, and high-voltage power supplies – with natural space plasma environments can actively drive spacecraft conductive structure charging by the selective emission or collection of charged particles, as demonstrated during Space Shuttle flights STS (Space Transportation System)-45 (1992) and STS-75 (1996) (Katz et al., 1994; Gentile et al., 1998) and more recently by the Upper Atmosphere Research Satellite (Frahm et al., 2002) and the International Space Station (Wright et al., 2008; Reddell et al., 2006). Charging of the spacecraft conducting structure can occur only if an electrical connection is present between the spacecraft conducting structure and the surrounding space plasma environment. Metallic structure exposed to the space plasma environment can also play a role in spacecraft charging by voltage-dependent collection of charged particles from the local space plasma environment (Katz et al., 1994). If the spacecraft is large enough, motional electromotive force, which is caused by flight at orbital speed through planetary magnetic fields, can lead to significant voltage gradients and currents in the spacecraft conducting structure, as exemplified by the well-known satellite electrodynamic tether systems (Gentile et al., 1998).
Spacecraft Configuration and Flight Environment Effects
Current balance models
Spacecraft surface and structural charging interactions are modeled with charge balance or charge accumulation equations that describe the relationship between spacecraft voltage, Vs, relative to some reference voltage, and the magnitude of the positive (+I) and negative (–I) charge particle electrical currents impinging on the spacecraft. If both ions and electrons can contribute to spacecraft charging, the net charge accumulation on the spacecraft is zero at steady state. We therefore have:
(6)
The steady state model embodied in eq. (6) is a useful approximation in many applications. However, in cases where the vehicle capacitance is large or during highly dynamic space flight environments, the net current cannot be neglected and electric charge of one sign or the other accumulates on the spacecraft at various rates while spacecraft voltage changes. If charged particle impingement and emission is the dominant spacecraft charging process, spacecraft voltage is a function of time and will depend on the net charging current, charged particle kinetic energy spectrum, and voltage of the target structure so that:
(7)
Note that the electromotive force (measured in volts) generating the structure voltage may originate either external to (e.g., energetic charged particles) or internal to (electrical power supplies) the spacecraft. For a given net charging current, the capacitance of the spacecraft will determine the time dependence of the spacecraft voltage as shown in the section below.
Spacecraft configuration and environments effects – Example 1: charging by auroral electrons
Charging of spacecraft in an 800-km polar orbit, as a result of flight though auroral electron streams, depends on:
• Capacitance of electrically isolated spacecraft components.
• Area of spacecraft exposed metallic structure.
• Availability of ionospheric plasma to mitigate both surface and frame charging.
• Magnitude of the auroral electron current.
• Secondary and photoelectron emission characteristics of the spacecraft materials.
The simple exponential capacitor charging equation found in elementary electrical engineering and physics texts is generally not applicable to spacecraft charging environments. This is because the simple exponential charging law is derived assuming constant voltage is provided by a power supply that can provide any current needed. In space, the current is varying and much smaller than the maximum possible current during most of the charging time and independent of charged particle stream kinetic energy or voltage until the spacecraft voltage approaches particle stream voltage. So, we have to ask how a capacitor will charge when the available current is not dependent on the voltage driving the current and is substantially smaller that the maximum possible current during most of the charging time.
If Q is the stored electrical charge in coulombs, then capacitance is defined by:
(8)
Another important question concerning the spacecraft or component capacitance is whether or not it is best described as an isolated metallic object (free-space capacitance) or a capacitor plate with a dielectric surface coating. If the contribution of the plasma sheath capacitance is small (1/ λ << 1), the free space capacitance of a metallic sphere of radius R meters is given by eq. (9):
(9)
Similarly, for a thin flat metallic disk of radius (a) meters, we have:
(10)
If the sphere or disk has a thin dielectric coating, the radius in eqs. (4) and (5) is replaced by the definition of capacitance for a parallel plate capacitor, C = πR2/d, where πR2 is the area of the object and d is the thickness of the dielectric film. Then, for the sphere and the disk respectively, we have:
(11)
and
(12)
It should be clear from eqs. (9) through (12) that any object with a dielectric film thickness, d, on the order of 10 μ and an area, πR2, on the order of 1 m2 will have a parallel plate capacitance that is 104 times larger than the free-space capacitance.
Some examples of spacecraft voltage (floating potential) values that might be expected for this simple auroral charging model are shown in Table 8.6.2. The radius of the sphere and the disk is 1 m. Final voltages were calculated using V = Q/C with charge Q in coulombs. Q = i × πR2 × t, where Q is charge in coulombs, i is the net auroral electron current per unit area in amps per m2, πR2 is the area of the object in m2, and t is the spacecraft auroral electron stream exposure time in seconds. The particle stream kinetic energy is assumed to be 30 keV; and t, the exposure time, is 1 s. Note that the voltage cannot exceed the assumed kinetic energy of the incoming charged particle current. Note, too, that the assumed auroral electron current to the spacecraft is a net current; i.e., it is the difference between the incoming auroral electron current and the total neutralizing current, which is simply the sum of secondary and photoelectron ejection currents and the ion current:
(13)
The results of the capacitor charging calculation shown in Table 8.6.2 demonstrate that small spacecraft or isolated dielectric surfaces that have very small capacitance can charge to high voltages quickly, while spacecraft that have high capacitance experience very small voltage changes. It should also be noted that if the properties of exposed spacecraft materials support sufficiently high secondary and photoelectron yields and/or the ambient ion density is high enough, little or no auroral charging will be observed for the assumed conditions.
Table 8.6.2
Effects of spacecraft capacitance on auroral charging
| Case | Capacitance pF | Floating potential, volts |
| Sphere – free space | 111.26 | 30,000 (charging time <1 second) |
| Sphere – 10 μ dielectric film | 1.26 × 106 | 75 |
| Disk – free space | 70.83 | 30,000 (charging time <1 second) |
| Disk – 10 μ dielectric film | 3.3 × 105 | 95 |
| International Space Station U.S. Laboratory Module | 4.4 × 109 | 0.293 |
| Estimated International Space Station total | 1.1 × 1010 | 0.636 |
| U.S. extravehicular mobility unit∗ | 1.5 × 106 | 6.67 |
Spacecraft configuration and environments effects – Example 2: International Space Station
The dominant spacecraft charging processes for the International Space Station, which operates in low-temperature, high-density ionospheric plasma, differ greatly from those typically observed for smaller spacecraft in geosynchronous or low-polar Earth orbit (Garrett & Whittlesey, 2000; Hastings, 1995) where surface mitigation by the ionospheric plasma is unavailable and energetic charged particle fluxes can be much higher. It is ironic that the same ionosphere that mitigates the energetic electron-driven charging processes in low Earth orbit is the principle cause of International Space Station charging (Wright et al., 2008; Reddell et al., 2006).
The physical processes driving International Space Station spacecraft charging can be illustrated with the simple, heuristic, current balance model shown in Figure 8.6.1. In the simple model, strings of photovoltaic cells are connected by exposed metal interconnects and have exposed photovoltaic cell edges, both of which can collect current from the surrounding plasma. The connected photovoltaic cells are arranged in linear strings so the voltage difference is 160 V between one end of the panel and the other end of the panel (note that station photovoltaic arrays do not use exposed metallic interconnects). We can then determine the floating potential (i.e., the potential difference between the spacecraft conducting structure and the ambient plasma) of the solar array as a function of position along the array by determining the X coordinate at which the floating potential is zero (assuming that the plasma charging current is large enough and the photovoltaic string capacitance is low enough so that steady-state floating potential is achieved rapidly). The gas kinetic speed of the plasma ions is much lower than the speed of the orbiting spacecraft, so ion collection is possible only on forward-facing conducting spacecraft surfaces. The gas kinetic speed of the plasma electrons is much greater than orbital velocity, so electron collection is modeled as “thermal current”, as described by the basic kinetic theory of gases and plasmas. The photovoltaic string is assumed to be oriented so that exposed metal interconnects and photovoltaic cell edges are on the ram, not the wake side of the photovoltaic structure. It follows, as shown in Figure 8.6.1, that A-/A+ = 0.19 in low Earth orbit and that most of the solar array area is ion collecting while only a small fraction of the area is electron collecting.
Now we can calculate the solar array floating potential at X = 0 and X = L. Because the ion surface flux per unit area is always much smaller than the electron surface flux per unit area in low Earth orbit, this calculation turns out to be +26 V at X = 0 and –134 V at X = L simply because the electrons are much less massive than the ions while ions and electrons have the same or comparable kinetic energies.
If the exposed conducting structure attached to the negative end of the solar panel is metallic, the floating-potential numbers will be more positive as a result of limited additional ram ion collection by the structure. However, a plasma contactor emitting electrons can bring the attached structure to a floating-potential value near zero.
If the structure at the negative end of the solar array is coated with a thin dielectric film (e.g., anodized aluminum), the full value of the floating potential will be applied across the film because the outer surface of the film collects charge from the ionosphere in response to the electrostatic field of the underlying metal. The coated structure can function as an energy storage capacitor, and any dielectric breakdown arcing that follows can be energetic enough to damage the film and generate electromagnetic interference in the structure (Garrett & Whittlesey, 2000; Hastings, 1995). Of course, all else being equal, coating the attached structure with a thin dielectric coating also increases the capacitance of the system and the charging time.
A simple equivalent electrical circuit representing the heuristic International Space Station charging model is shown in Figure 8.6.2. Station charging is observed to be much less severe than the simple heuristic model predicts as a result of physical limitations on electron collection imposed by station photovoltaic cell geometry (no metallic interconnects and limited photovoltaic cell edge exposure) and the presence of about 35 m2 of ion-collecting area on the station. The simple heuristic model is surprisingly accurate with a number of low Earth orbit spacecraft (Brace, 1998; Frahm et al., 2002) subject to this charging process and able to efficiently collect electrons with exposed metallic interconnect photovoltaic cell strings.
FIGURE 8.6.2 An electrical circuit representing the simple heuristic International Space Station charging model.
A similar calculation can be performed for a large metallic structure flying through the geomagnetic field at orbital velocity, in which the end-to-end motional electromotive force potential difference is given by eq. (14):
(14)
where v is spacecraft velocity vector, B is the local geomagnetic field vector, L is the length of the spacecraft conducting structure perpendicular to the velocity vector, Δϕ is the end-to-end potential difference, × is the vector cross-product operator, and ⋅ is the scalar product operator.
Analysis tools for spacecraft charging with detailed configuration and environmental effects
The simple heuristic modeling approaches described in the previous section and this section are simplifications of more complex situations designed to illustrate spacecraft charging processes. Detailed, physically complete modeling and analysis tools should always be used in real-world spacecraft charging hazard assessment and control work.
The spacecraft charging literature is vast, and the reference list for this chapter is far from exhaustive. The Space Environment Effects Project at the NASA Marshal Space Flight Center maintains a Web page and a complete collection of standards and guidelines, research publications, and analytical tools on this subject (NASA SEE Project). The European Space Agency SPENVIS Web page also offers a wide range of publically available on-line analytical tools for spacecraft charging analysis (ESA SPENVIS).
The listed handbooks and standards contain detailed guidance on spacecraft charging analysis and hazard control methodology. The subject of spacecraft charging control has been recently reviewed (Lai, 2003) and is the subject of a soon-to-be-released textbook (Lai, 2011).
A short list of key reference handbooks, standards, and modeling tools follows:
• Department of Defense. (2007) Requirements for the Control of Electromagnetic Interference Characteristics of Subsystems and Equipment. MIL-STD-461F. Washington, DC: Department of Defense.
• Department of Defense. (1987) Electromagnetic Compatibility Requirements for Space Systems. MIL-STD-1541A. Washington, DC: Department of Defense.
• National Aeronautics and Space Administration. (1999) Avoiding Problems Caused by Spacecraft On-Orbit Internal Charging Effects. NASA Technical Standards Program Document NASA-HDBK-4002. Pasadena, CA: National Aeronautics and Space Administration, Jet Propulsion Laboratory.
• National Aeronautics and Space Administration. (2007) Low Earth Orbit Spacecraft Charging Design Handbook. NASA Technical Standards Program Document NASA-HDBK-4006. Washington, DC: National Aeronautics and Space Administration, NASA Headquarters.
• National Aeronautics and Space Administration. (1984) Design Guidelines for Assessing and Controlling Spacecraft Charging Effects. NASA Technical Paper NASA TP-2631. Cleveland, OH: National Aeronautics and Space Administration, Lewis Research Center.
• European Space Agency. (2008) Space Engineering, Spacecraft Charging Standard, European Cooperation for Space Standardization. ECSS-E-ST-20-06C. European Co-operation for Space Standardization, European Space Agency.
Spacecraft Charging Hazard Effects and Mitigations – General Considerations
The most common hazard effects of the spacecraft charging hazard cause are:
• Electrical power system anomalies.
• Surface performance property degradation caused by arcing.
• Increased attitude control propellant use rates (energetic surface arcing can be propulsive).
The most immediate causes of the subject anomalies are dielectric breakdown arcing resulting from the accumulation of electric charge on or in a spacecraft or spacecraft component and the collection of electric current from the space plasma environment by electrically biased, exposed conducting surfaces.
The possibility of a spacecraft crew being exposed to electric shock hazards is a recently recognized hazard for International Space Station operations that is expected to become a more general concern as the range and scope of human space flight activities increases. The two most obvious approaches to spacecraft charging hazard control are to prevent charging and arcing, and render the effects of charging and arcing largely harmless.
The simple heuristic modeling approaches described previously are simplifications of more complex situations designed to illustrate spacecraft charging processes. Detailed, physically complete modeling and analysis tools should always be used in real-world spacecraft charging hazard assessment and control work.
Grounding, bonding and electromagnetic compatibility
The recommended spacecraft grounding and bonding practices contained in the documents (see previous section on “Analysis tools for spacecraft charging with detailed configuration and environmental effects”, p. 530) can reduce significantly the risk of avionics and power system anomalies caused by surface dielectric breakdown arcing and surface current collection from the ambient space plasma. However, the general effectiveness of this approach to mitigating the effects of deep dielectric charging is unclear and depends specifically on where the deep dielectric charge might accumulate and the effects of high-voltage gradients and dielectric breakdown at that location. In general, grounding, bonding, and electromagnetic interference/electromagnetic compatibility control are not effective against deep dielectric charging/discharging but are highly effective against surface charging/discharging.
Spacecraft configuration and materials selection
While it is true that controlling spacecraft configuration and materials can largely eliminate the cause of spacecraft charging hazard and greatly mitigate the effects, it is also true that spacecraft charging control is only one of many competing performance requirements. The most effective solution to controlling the deep dielectric charging problem is shielding mass sufficient to reduce energetic electron currents to negligibly small values. The spacecraft mass budget may not allow this solution, however. Fine-tuning dielectric material conductivity and relaxation times to prevent severe internal charging in the expected worst-case energetic particle environments is an alternative control method, but such fine-tuning still has to be implemented in the context of electronic systems performance requirements.
Similarly, the use of static dissipative dielectric materials or conductive coatings on spacecraft surfaces can prevent problems arising from differential charging, but only in the context of the overall spacecraft system performance requirements. A conductive coating of indium tin oxide has been used successfully on many spacecraft; the European Space Agency Freja satellite (Eriksson & Wahlund, 2006) is an especially well-documented example of this.
Fine metallic thread is woven into the thermal control blankets on Russian Progress and Soyuz spacecraft provide for charge dissipation by means of the resulting very fine wire mesh in which the wire separation or effective grid opening is much less than 1 mm. The use of a more open grid or mesh of metallic wires, in which separation between the wires is measured in centimeters instead of in microns, can limit the magnitude of electrostatic fields but leaves substantial areas of dielectric material open to charging. Uniform potentials will be present along the wires, but the dielectric areas between the wires will still be charged, leading to periodic potentials and even breakdown arcing in the dielectric. While in some cases the grid or mesh has proven useful, the use of either is not generally recommended.
The selection of dielectric materials of sufficient thickness and sufficiently high dielectric breakdown threshold can prevent arcing but cannot prevent charging. Spacecraft materials selection thus depends on knowing the worst-case spacecraft charging environment for purposes of materials selection and design verifications.
Spacecraft that actively charge themselves through interaction of a high-voltage system with the space plasma environment can obviously profit from configuration changes that block the collection of electron current by the high-voltage system and increase the collection of ions by exposed conducting materials. High-voltage photovoltaic systems operating in low Earth orbit ionospheric plasma are important examples of this, and photovoltaic array-driven charging can be minimized by minimizing the total area of exposed metal and silicon that can collect electrons (Katz et al., 1994; Reddell et al., 2006) and providing a sufficient area of exposed metallic conductor that can collect ram ions. However, the relatively large areas of ion-collecting surface needed to offset a modest electron current (~1 m2 of ion-collecting area per milliamp of electron current) often makes the passive ion collection method impractical (Koontz et al., 2003).
Spacecraft power production and distribution systems can be especially susceptible to dielectric breakdown arcing if they are not configured properly. Spacecraft have been lost when charging and arcing events in or on the power system components enabled power system arc tracking events (Cho et al., 2006). The initial trigger arc caused by spacecraft charging can couple main spacecraft power into a much larger, prolonged, and more damaging arc. The risk of arc tracking can be minimized by careful materials selection and configuration control. Separating high-current conductors in power production and distribution circuits, using system configurations that minimize voltage difference between adjacent high-current conductors, and selecting materials that are expected to retain dielectric and mechanical performance properties during the life of the spacecraft contribute to managing the spacecraft-charging triggered arc tracking hazard (Cho et al., 2006; Katz, Davis & Snyder, 1998).
Active spacecraft charging control
Spacecraft employing electric propulsion or emitting high-voltage particle beams require active charging controls. Operation of ion and Hall effect thrusters may drive the spacecraft conducting structure to high-negative voltages by emitting an electrically polarized stream of plasma. The negative voltage buildup on the spacecraft would soon reduce thrust to zero without active neutralization. Spacecraft employing electric propulsion – e.g., Deep Space 1 (Polk et al., 2001), SMART (Gonzalez del Amo et al., 2004), Dawn (Rayman et al., 2006), and Hayabusa (Kuninaka et al., 2007) – all use hollow-cathode electron emitters or plasma contactors to actively control the spacecraft conducting structure by providing a low-impedance path for electrons to neutralize the positive ion beam.
Active charging control methods have also proven important as a means of mitigating surface charging processes in geosynchronous orbit, as described for the Defense Satellite Communication System-III B-7 satellite (Krause et al., 2004). The Defense Satellite Communication System-III B-7 satellite’s xenon plasma contactor was operated only as needed to manage the effects of the severe spacecraft conducting structure and differential surface charging caused by space weather events such as geomagnetic storms and sub-storms. Operation of the Defense Satellite Communication System-III B-7 plasma contactor was triggered by specific surface charging sensors installed on the spacecraft. Plasma emitted by the subject plasma contactor provided control of both spacecraft frame and surface dielectric materials charging. The relatively dense, low-temperature plasma emitted by the plasma contactor provided a source of ions and electrons to neutralize surface charge on the spacecraft dielectrics while also providing a low-impedance pathway for the return of any excess charge on the spacecraft frame back to the local space plasma environment.
The ability of plasma contactor ions and electrons to neutralize surface charges on dielectrics depends on the velocity of the spacecraft with respect to any environmental magnetic fields. The plasma contactor plasma will, as a gaseous conductor, interact with magnetic fields such that the ions and electrons will tend to move along and orbit the field lines. If the spacecraft is stationary with respect to the magnetic field, the plasma will expand by diffusion along the field lines. If the spacecraft is moving at high speed with respect to the field lines, the plasma will still expand by diffusion along the field lines; but, because the spacecraft is moving through the magnetic field at high speed, the stationary field lines will “pick up” ions and electrons. As a result, the plasma can streams behind the spacecraft and is less available to neutralize differential surface charging (Cairns & Gurnett, 1991; Krafft & Volokitin, 1999).
Operational spacecraft charging control
In some cases, operational hazard controls can be employed to mitigate the spacecraft charging hazard and protect the vehicle against hazard effects. An event-triggered operation of the Defense Satellite Communication System-III B-7 plasma contactor is an example of one type of operational hazard control.
Managing frame charging by changing spacecraft flight attitude so as to change the current collecting metallic surface area was successfully demonstrated during Space Shuttle flights STS-45 and STS-75 (Katz et al., 1994; Gentile et al., 1998). Flight attitude and photovoltaic array management supplement the plasma contactor system during extravehicular activity on the International Space Station, as described in more detail in the next section. Operational control of solar-array-driven charging in low Earth orbit can be accomplished by shunting the array or orienting the array so the array surface that is collecting electrons and ions is pointing aft (in wake).
Shunting essentially reduces the output voltage of the photovoltaic array to near zero by electrically shorting the photovoltaic cell strings. Shunting is often a photovoltaic power system requirement to prevent overcharging of batteries and power system damage. Alternately, the photovoltaic array can simply be disconnected from the rest of the power system; however, this approach maximizes spacecraft charging risk by leaving an open circuit (maximum string voltage) photovoltaic array that is still collecting plasma current grounded to the spacecraft.
Photovoltaic arrays, when shunted, produce little or no useful power for the spacecraft. Shunting is one of the basic contingency or backup hazard controls for International Space Station extravehicular activity operations, as presented in the next section.
Spacecraft Charging – International Space Station Lessons Learned
International Space Station spacecraft charging processes
A photograph of the International Space Station, as it appeared after construction flight 20A (Space Shuttle flight STS-130), is shown in Figure 8.6.3. The velocity vector is perpendicular to the long truss structure and aligned within a few degrees of the long axis of the pressurized elements in the nominal flight attitude (+XVV).
FIGURE 8.6.3 The International Space Station after construction flight 20A in early 2010; the velocity vector for the +XVV flight attitude is shown as a white arrow, coaxial with the pressurized element stack.
Note also the position and orientation of the 160-V Sun tracking photovoltaic arrays on each end of the truss structure. The main contributors to spacecraft charging for the International Space Station are current collected from the ionospheric plasma by high-voltage photovoltaic array strings and motional electromotive force (produced by flight of the truss structure through Earth’s magnetic field at high latitude) (Wright et al., 2008; Reddell et al., 2006). The physical character of the station charging processes differ greatly from those typically observed for smaller spacecraft in geosynchronous or low-polar Earth orbit.
The International Space Station operates in an electrically conductive environment: the F2 ionospheric plasma. Station charging is driven primarily by electromotive force or voltage sources internal to the spacecraft and in electrical contact with the F2 plasma, specifically the 160-V photovoltaic power system and the motional electromotive force effects that result from flight of a large metallic structure at orbital speed through Earth’s magnetic field (Wright et al., 2008; Reddell et al., 2006). The source of charged particle currents is the relatively cold, dense F2 ionosphere. Ionospheric currents are often much larger than, for example, photoemission and energetic charged particle currents for spacecraft in low Earth orbit (Hastings and Garrett, 1996; Whipple, 1981; Garrett & Whittlesey, 2000; Hastings, 1995). Figure 8.6.4 illustrates the magnitude of current that can be collected from the F2 ionosphere by an electrically biased conducting sphere. Data shown in Figure 8.6.4 are from the floating-potential measurement unit Langmuir probe now deployed on the International Space Station (Kramer et al., 2010). Even at the low bias voltages shown in the figure, positive bias voltage can lead to the collection of many milliamps of electron current per square meter of probe area while ion collection is significantly smaller.
FIGURE 8.6.4 Floating potential measurement unit (FPMU) Langmuir probe electron current as a function of voltage bias relative to International Space Station conducting structure for a large number of 1-s voltage sweeps collected over many of orbits during several days. Even small positively biased surfaces can collect milliamps of electron current at small bias voltages in low Earth orbit. The variation in electron currents is due to natural ionosphere variability. (Kramer et al., 2010)
Preflight modeling of International Space Station charging predicted a floating potential near −140 V during every orbital day pass, a result that is within 15% of the estimate produced using the simple heuristic model described in Example 2 on p. 119 (Carruth et al., 2001). Early in-flight measurements of station charging after deployment of the first 160-V photovoltaic array invalidated the preflight model, however. Maximum measured floating potentials were on the order of 20-fold lower than those predicted for the early configurations (Mikatarian et al., 2002). Station plasma contactor unit emission currents and floating-potential probe voltage measurements confirmed the presence of station charging processes, but not of the severity predicted by the preflight model (Koontz et al., 2003; Mikatarian et al., 2002; Mikatarian et al., 2003; Mandell et al., 2003).
The overall approach to assessing International Space Station charging is described in Koontz et al., (2003). A plasma and spacecraft diagnostics package – the floating-potential measurement unit – was designed and built to ISS Program specifications by Utah State University/Space Dynamics Laboratory to enable routine measurements of station floating potential. The floating-potential measurement unit has been described previously in Wright et al., (2008). In parallel, a physics-based model station charging was developed by the Boeing Company and Science Applications International Corporation. The resulting International Space Station charging model – called the Plasma Interaction Model – was developed to be a reliable theory-predictive model with minimum reliance on empirical adjustable parameters whose value had to be determined by fitting data to the model. The multi-year campaign of station charging and ionospheric environment measurements, which was made with the floating-potential measurement unit across many station configurations culminating in the final “assembly complete” configuration, provided in-flight data for verification and refinement of the station charging model of the Plasma Interaction Model developed by the Boeing Company and Science Applications International Corporation (Mikatarian et al., 2002; Mikatarian et al., 2003; Mandell et al., 2003).
Understanding the variability of Earth’s ionosphere on different timescales ranging from seconds to weeks, which is not adequately represented in climatological models such as the International Reference Ionosphere, was an essential part of developing a predictive model that could be used to perform hazard assessments and hazard control work (Minow et al., 2003). Recovery and analysis of much of the satellite flight data used to construct International Reference Ionosphere models is basic to our approach (Minow et al., 2003).
The magnitude of the International Space Station charging effects depends on the characteristics of both the spacecraft itself and the charging environment in which the spacecraft operates. Important spacecraft considerations include:
• Physical size and capacitance.
• Electrical grounding and bonding.
In addition, the station is a large vehicle that produces a deep wake structure from which both ionospheric plasma and neutral species abundance are diminished.
The International Space Station charging environment depends on the level of solar and geomagnetic activity (space weather) as well as the orbital location (altitude, latitude, longitude). Important spacecraft charging environment factors include: ionospheric temperature and density along the vehicle flight path; ionospheric electrical potential gradients driven by high-altitude neutral winds or electric field penetration from the magnetosphere; and auroral electron precipitation. The small variations of the geomagnetic field resulting from space weather activity can generally be ignored for practical purposes (Cairns & Gurnett, 1991; Krafft & Volokitin, 1999).
International Space Station charging instrumentation and measurements
The International Space Station is equipped with a set of tools developed to monitor the environmental plasma state. This instrumentation comprises a floating-potential measurement unit developed for NASA, which is described by Wright et al. (2008) and references contained therein. The floating-potential probe, among the complement of instruments incorporated in the floating-potential measurement unit, is a gold-plated spherical shell isolated from the bonded structure by approximately 1011-Ω impedance and deployed on a 150-cm boom. The floating potential uses an inverting instrumentation amplifier circuit so that negative floating potential is reported as a positive number and positive floating potential is reported as a negative number.
The electrically conducting nature of the plasma provides a well-known shielding effect associated with the attraction and enhanced concentration of opposing polarity charge carriers in the plasma volume near any charge. This shielding property, which is characterized by a length scale properly known as the Debye length, is effective in isolating the floating-potential probe from disturbances associated with nearby charged surfaces. The floating-potential measurement unit deployment on the 150-cm boom, in particular, locates the floating-potential probe at least two Debye lengths away from any other structure over the range of plasma state conditions achieved on orbit. The floating-potential probe sphere therefore floats near the plasma potential, providing a reference for measurement of the International Space Station.
Figure 8.6.5 is an example of floating-potential measurement unit telemetry along with the theoretical calculation of a floating potential. The figure shows peak modeled potential at eclipse exit compared to the corresponding measured value from the floating-potential measurement unit. The upper panel illustrates the floating-potential probe data and the Plasma Interaction Model (see next section) calculation for four orbits in mid-November 2009. The abscissa scale is coded to show eclipse – sunlit segments. Hatched segments are sunlit orbit intervals. We observe that the potential in the upper panel reflects a negative potential of vehicle structure relative to the floating-potential probe shell.
FIGURE 8.6.5 Example of FPMU telemetry collected November 18, 2009, with corresponding Plasma Interaction Model theoretical simulation for four orbits of the International Space Station. The solid line in the top panel is observed vehicle floating point relative to deployed probe. The dotted line in the top panel is the theoretical floating point referred to probe location and based on measured electron density (n) and temperature (T) seen in the bottom two panels. The light and dark bands at the bottom figure indicates when the International Space Station was in eclipse (dark) or in sunlight (light).
The plasma state that is comprised of electron temperature, T, and plasma density, n, is determined by Boeing’s Langmuir probe reduction process. There are two Langmuir probes: a spherical wide bias range cylindrical probe, known as the wide Langmuir probe, and a narrow-range cylindrical probe, known as the narrow Langmuir probe.
The floating-potential measurement unit itself was subjected to a detailed failure mode and effects analysis aimed at identifying instrument failures that could lead to an inability to detect real hazardous conditions. Direct validation of floating-potential measurement unit measurements of ionospheric temperature and density against ground-based assets such as incoherent scatter radar at Millstone Hill (Massachusetts Institute of Technology) are also conducted periodically to validate the floating-potential measurement unit measurements. An example of a floating-potential measurement unit–Millstone Hill comparison, which was taken from two specific flyover events, is shown in Figure 8.6.6. Periodic revalidation of the floating-potential measurement unit – using floating-potential measurement unit data collected when the International Space Station passes over Millstone Hill whenever the incoherent scatter radar is operational and producing ionospheric temperature and density data – is an ongoing station activity.
FIGURE 8.6.6 FPMU measurements of ionospheric temperature and density compared to simultaneous Millstone Hill incoherent scatter radar during two flyover events. The circled Xs correspond to floating potential measurement unit data taken at closest approach to the incoherent scatter radar zenith. Vertical dashed lines mark orbital sunrise.
International Space Station charging model development and validation
The Plasma Interaction Model is a non-steady-state solver based on a principle of electric charge conservation. As previously noted (Garrett & Whittlesey, 2000; Hastings, 1995), the International Space Station is not subject to the differential surface or deep dielectric charging processes that plague smaller spacecraft in more severe charging environments, with the possible exception of the anomalous charging peaks sometimes observed during the very low ionospheric densities reported in the previous section. Active charging of station conductive structure as driven by electromotive force sources internal to the vehicle is the most important charging process for the International Space Station and its safety analysis. The floating potential in the Plasma Interaction Model is simulated by calculating the equivalent energy associated with a dynamic electric charge confined to a capacitance. The floating potential in this approach is a singular potential relative to the external plasma at each point on the spacecraft. At the same time, solar arrays working voltage and geomagnetic motional electromotive force distribute electrical potential across the structure. The vehicle capacitance corresponds to the thin dielectric anodized material covering the bonded aluminum vehicle structure. Structural metal comprises one side of the capacitance while the conducting environmental plasma comprising the other side of the capacitance is determined from fundamental material properties of the coating. The accumulation of charge is accounted for in accord with integrated positive and negative electric currents collected on the conducting structure.
To achieve this accounting, the Plasma Interaction Model incorporates subsystem model elements from three current collecting components. These components are the International Space Station solar arrays, exposed conductors on the solar array masts, and exposed conductors on Russian elements of the station. Plasma density and temperature govern current collection characteristics to first order. Current collection characteristics in the Plasma Interaction Model are also governed by the magnitude and orientation of the geomagnetic field. The geomagnetic field creates an induced voltage between all parts of the structure and the plasma. The induced field is realistically modeled in the Plasma Interaction Model and distributed over the station structure according to the geographic location determining magnetic field and recorded vehicle attitude. While this feature is used in post-flight analysis, the code also functions as a prediction code using the well-known International Reference Ionosphere to define the station plasma environment.
The performance of the Plasma Interaction Model is shown in Figure 8.6.7, in which Plasma Interaction Model predictions are compared with floating-potential measurement unit measurements (Kramer et al., 2010). By inspection, the agreement is excellent for the hundreds of data points taken over several International Space Station construction configurations (station flights 11A to ULF (utilization logistics flight)-2).
FIGURE 8.6.7 Validation of the Plasma Interaction Model charging model vs. floating-potential measurement unit data for negative floating potentials (reported as positive numbers by convention).
The correlation plot on the left side of Figure 8.6.7 does show a number of data points that suggest the existence of large negative floating-potential charging events not predicted by the Plasma Interaction Model. These floating-potential measurement unit data points correlate with the very low ionospheric densities at eclipse exit, and serve as examples of a new and unanticipated station charging mechanisms. A second plot, with the low electron density events removed, appears on the right side of Figure 8.6.7. The station plasma contactors control vehicle charging that is produced by the recently discovered and currently unexplained charging phenomena; however, the duration of the charging events is typically less than 5 s, which means that any possible hazard exposure, with the power control units off, is of very limited duration.
It should be noted that the floating-potential measurement unit data in Figures 8.6.7 and 8.6.8 were collected during the unusually deep and prolonged solar minimum of 2007 to 2010 from which we are only now emerging (Lei et al., 2010). During that time, ionospheric densities were significantly lower than the minimum possible values that the International Reference Ionosphere (Bilitza & Reinish, 2008) could calculate, so the International Space Station floating potential, using International Reference Ionosphere predictions, was substantially lower than would be expected normally during much of that time.
FIGURE 8.6.8 Validation of the Plasma Interaction Model charging model vs. floating-potential measurement unit data for positive floating potentials (reported as negative numbers by convention).
The Plasma Interaction Model, the floating-potential measurement unit, and our understanding of ionospheric variability play important roles in station operations planning and spacecraft charging hazard management. By combining the Plasma Interaction Model with historical satellite databases of ionsopheric temperature and density (over altitude, latitude, and longitude ranges applicable to the International Space Station vehicle), we can calculate the historical probability of exceeding specified floating-potential values on the station centerline and truss tips.
The cumulative probability of a floating potential greater than some number X is shown in Figure 8.6.9 for a series of International Space Station configurations. The station floating-potential map, which corresponds to the worst observed case, is shown in Figure 8.6.10 (Reddell et al., 2006). Note that while solar array charging is uniform over the International Space Station, high-latitude magnetic induction is a vector quantity and so varies with location on the vehicle. The result of combining the two charging causes is shown in Figure 8.6.10. Note also that the subject worst case is expected to occur only briefly during one orbit out of 10,000 or more.
FIGURE 8.6.9 Frequency of occurrence of International Space Station floating-point values great than X calculated using the Plasma Interaction Model and applicable historical ionospheric satellite data (10,000 data points spanning several years). (Reddell et al., 2006)
FIGURE 8.6.10 Floating-potential map for worst-case International Space Station charging with plasma contractor units off and the station in the +XVV flight attitude; expected frequency of occurrence is one orbit out of 10,000 or more. (Reddell et al., 2006)
International Space Station spacecraft charging hazards: Identification, assessment and control
International Space Station spacecraft charging hazard analysis proceeded in parallel with an assessment of spacecraft charging physics, beginning with the early International Space Station Program decision to use a negative-polarity ground 160-V solar photovoltaic power system.
To address the then poorly characterized spacecraft charging risks that could result from this solar electrical power system configuration, the International Space Station, following the recommendation of the Electrical Grounding Tiger Team final report, was equipped with two plasma contactor units to manage or mitigate vehicle charging (Brewer, 2010). The only hazard identified by this tiger team was the loss, over a period of several months, of some thin thermal control coatings from the external surfaces of the pressurized module micrometeoroid and debris shields due to the expected, almost continuous dielectric breakdown arcing of thin anodic films on aluminum substrates. No electromagnetic interference/electromagnetic compatibility, extravehicular activity, or visiting vehicle interoperability hazards were identified at that time. It was often noted that the preflight model of station charging was likely overly conservative as a result of the many worst-case assumptions driven by a lack of applicable data and the generally relatively primitive state of low Earth orbit spacecraft charging analysis at that time.
The Plasma Contactor Unit Tiger Team was formed a year prior to launch of the first 160-V photovoltaic array (contract year 2000) to review the results of the earlier tiger team and determine whether the plasma contactor unit system was still required by the International Space Station Program. The findings of the first tiger team were largely confirmed preflight, with one important exception: The catastrophic extravehicular activity shock hazard was identified for the first time and documented in both HR-ISS-EVA-312 (report not available publicly, contact authors to request access) and in associated nonconformance reports. The launch of the International Space Station plasma contactor unit system on flight 3A and of the floating point potential on flight 4A also provided real in-flight data to test the preflight station charging model for the first time, thus discrediting this preflight charging model and leading to a number of changes to vehicle operations planning and flight procedures as well as to a campaign to develop a new, reliable, “physics-based” charging model and to validate that model with ongoing in-flight measurements. The possibility an extravehicular activity crew receiving an electric shock through direct contact with high-voltage equipment – a possibility not directly caused by spacecraft charging that has long been recognized – is managed by special extravehicular activity procedures and tools.
As a result of the floating-potential data campaign, with supporting data from International Space Station plasma contactor unit emission current measurements, the loss of thermal control coating due to surface dielectric breakdown arcing was declared critical, though not catastrophic, and was documented in ISS-EVA-305 (report not available publicly, request access by contacting authors). Extravehicular activity touch-temperature violations on degraded surfaces are the only hazard effect recognized in this report. In-flight floating-potential measurement unit measurements and validated Plasma Interaction Model predictions reveal a negligible amount of surface degradation is expected before end of the International Space Station Program in 2028, and also show no observed surface degradation due to dielectric breakdown arcing during the first 10 years of flight, as documented by photographic surveys of arcing-prone anodized aluminum surfaces on the station.
Electromagnetic interference/electromagnetic compatibility effects – both from arcing of station surface coatings and electrical current flowing, in undocumented ground loops involving the ionsopheric plasma, through the vehicle structure – are still a concern, although both documentation and analytical rigor have been improved greatly through the efforts of the NASA Engineering and Safety Center as documented in the Assessment of International Space Station Plasma Contactor Utilization Plan (NASA Engineering and Safety Center 2009; Keys, 2010; Koontz, 2010, export controlled and not publically available, request access by contacting authors). The conclusion of this report is contingent, however, on rigorous compliance with International Space Station grounding, bonding, and electromagnetic compatibility requirements. Undocumented ground or soft shorts can invalidate electromagnetic interference immunity.