dokumentname > 23.11.2004 sdl sequence: the system standpoint j. biele philae science team...

Dokumentname > 23.11.2004Dokumentname > 23.11.2004

SDL sequence: the system standpointJ. Biele

Philae Science team meetingVenezia, Palazzo Cavalli FranchettiMarch 30, 31, April 1, 2009

v2

Folie 2 > Vortrag > AutorSDL J. biele Jan 2009

SDL workshops, deadlines

SDL#1: Jan 28/29, 2009 Cologne

SDL #2: Feb 5/6, 2009, Cologne

SDL #3: Apr 28, 2009, Toulouse

Status is documented in Minutes of Meeting of SDL#2, version v0 of 25.03.2009.

SDL reference documents and presentations accessible from ftp server philae.dlr.de

DECISIONS to be taken by end-April 2009:

All decisions on CDMS S/W development

Test cases definition confirmation for end-2009 verification

Payload comments and requests


Summary status SDL workshop

RecommendationsADS tank opener activation before FW spin-upCheck whether there are nominal scenarios with MSS delta-v of 17,5 cm/s (like emergency release)Investigate additional Touch-down signal strategy (see attached flow chart)Fire 2nd harpoon unconditioned ~0,5 sec (tbc) after first oneAnchor rewind force: Use level 1 (4-5 N)Anchor rewind counter setting: 240 cmImplement "careful re-tensioning procedure“ (details to be defined for SDL_029)RF link to be established only tbd time after separation (15 min tbc) (details to be defined for SDL_023)Switch off RF units around touch-down (details to be defined for SDL_023)

DecisionsSDL model case definitions for ‘Core SDL’ and ‘Extended SDL’End-to-end SDL test incl. OBCPs will be performed during hibernationESS test in MPS Lindau planned for 2009 to check/confirm SAT application and setting first [Küchemann]; no action/due date is given yet.Go with automatic emergency eject (12 sec after nominal sep), but check for compatibilityLander temperature at separation shall NOT be ’as high as possible’ to avoid overheating ofBatteries; required temperature pending on thermal analysis for SDL and FSSNo CDMS Batteries temperature control during SDL (details to be defined for SDL_008)Anchoring Sequence Flowchart : Have "8 sec" timeout as parameter (sequence to be re-checked for short time-outs, 0,5-2 sec)


SDL – to be decided urgently

Final Anchoring sequence

Final touchdown detection

Final SDL test cases, experiment priorities

Final power (incl. Batteries temperature) managment

Final RF communication / MM scenario (what do we want? What can the Orbiter provide?)

Final CDMS software change requirements


CDMS SW Requirements from SDL Workshop

to be derived from…

- SDL_008 Monitoring of PBatt temperature by CDMS SW(No decision yet on battery temperature control by CMDS after SDL. But if decided, temperature limits as parameters, not fixed values!)- SDL_018 Criteria for 'PBatt empty' shall be configurable in CDMS SW- SDL_028 Provide optional anchoring sequence via RTTC- SDL_029 Proposal of re-tightening anchor procedure- SDL_030 TD detection by SESAME-SDL_031 Flowchart of updated TD detection scenario

All topics have to be confirmed in the next SDL_WG#3!


Status of reference documents

Philae SDL reference documentation, One doc added wrt. last version 26.1.2009 – now 3.2.2009

1. LID-B, RO-EST-RS-3020/LID B, iss. 3.0, 8.12.2004 (this is the Lander's answer to the EID-A, signed with ESA) 2. Rosetta Lander User Manual, RO-LAN-UM-3100-DLR, Iss. 4 Rev.: 0, 22.12.2005 (LUM iss. 5 under work) (this is the basic technical

description of the Lander and its units) 3. Crema, RO-ESC-RP-5500, ROSETTA: CONSOLIDATED REPORT ON MISSION ANALYSIS CHURYUMOV-GERASIMENKO 2004,

iss. 5.0 Aug. 2003 (this is the valid ROSETTA mission analyis including lander delivery; soon -2009- to be updated) 4. ROSETTA LANDER MISSION ANALYSIS WORKING GROUP FINAL REPORT, RO-ESC-RP-5003, Issue 1, April 1999, RO-ESC-RP-

5003 (this is the Lander MA still for Wirtanen) 5. Lander Mission Analysis SONC: ROS-TNO-LTAN-1771-CNES; iss. 1.1, 3.11.2004 (this is the latest detailed Lander MA for 67 CG; to

be updated in 2009) 6. SDL timeline (for testprocedure) "Basic", RO-LAN-TP-3431, iss. 2.5, 7.11.2003 (this is the input table upon which ref. 10 is based) 7. SDL timeline (for testprocedure) "Fast Descent", RO-LAN-TP-3432, iss. 1.0, 18.07.2003 (this is the input table upon which ref. 10 is

based but for short descent) 8. Lander (SSP) Separation Strategy, RO-DSS-TN-1213, iss. 1, 27.04.2005 (Astrium) 9. Lander Separation Tests Investigations RO-DSS-TN-1212, iss. 1., 27.04.2005 (Astrium) 10. SDL Separation&Descent&Landing Procedure, RO-LAN-TP-xxxx(3431), iss. 3.0, 29.09.2005 (SDL test procedure by A. Balasz, basis

for AMST 1000) 11. M. Hilchenbach: Rosetta Lander Modelling, RO-LAN-TN-3113, Iss. 1, Nov. 1999 OBSOLETE, DELETED FROM SERVER 12. M. Hilchenbach, H. Rosenbauer and B. Chares, FIRST CONTACT WITH A COMET SURFACE: ROSETTA LANDER SIMULATIONS L. Colangeli et al. (eds.), The New ROSETTA Targets, 289–296, (2004) (Landing simulations for 67P) 13. RO-LAN-LI-1000 (Rosetta Lander Scientific Objectives of the Philae Mission) (edited by H. Boehnhardt, Science Themes Lander) 14. Instrument Flight Operation Plans (IFOPS) by each PI team, 2008/2009 (the basic input by each experiment for the comet phase –

SESAME and Ptolemy update missing at the time being) 15. Definition of the Lander sequence for the Separation, Descent & Landing phase and for the touch-down phase, Moura&Biele

, ROS-NO-L-INTES-946-CNES, 17.5.2002, iss.3 (the overview document about SDL, status 2002) 16. ROSETTA LANDER: OBCP for LANDER User Requirements Document, RO-LAN-TN-3210, Iss. 8, 13.05.2003


Ref. docs, cont. 17. ROSETTA Lander Separation SAT Definition, Doc.No.: RO-LAN-TP-3901, Issue : 1 Revision : 0, Date : 29.04.2003 (for the ROSETTA LANDER Separation, Descent and Landing with SAT and OBCP) 18. ROSETTA Lander Test Report Separation Procedure with SAT on Orbiter level, RO-LAN-TR-3403, Issue : 1.0, Date : 19.11.2002 19. CDMS Detailed Design Document, RO-LCD-SW-3610, Version 6/98, 28.03.2008 20. Rosetta Lander Development & Validation Plan CDMS SW, RO-LCD-TN-3403, 1.1, 20/Jan/2009 (replaces CDMS General overview on SW

7.0 development, RO-LCD-TN-3401, Version 6/98, 28.03.2008) 21. CDMS Subsystem Specification, RO-LCD-SP-3101, Version 6/0, 02.09.2003 22. CDMS EEPROM Memory Map, Version 6/90, 12.01.2008 23. ESS SW User Manual, RO-CAP-MA-8001, Version 3/D, 06.09.2002 (Software V2f4) incl. Appendix A-F 24. RO-LAN-RD-1000 Requirements of Philae landing wrt Orbiter measurements and models, 2008 (towards ESA and the Orbiter instruments) 25. RO-LAN-RD-2000 Lander Model for Descent navigation and sensitivity analysis, 2008 (to define the Lander for Mission Analysis purposes, for

ESOC and SONC)26. Hilchenbach, M.; Küchemann, O.; Rosenbauer, H., Impact on a comet: Rosetta Lander simulations, Planetary and Space Science, Volume

48(5), 361-369, 2000 (Landing simulations for 67P)

27. ROS-NO-LAN-ETAN-1426-CNES; 08.04.2003, Landing Assessment on Comet CG (minutes of meeting)28. RO-EST-MN-0706 – May 03 - Comet Approach Mtg @ ESOC (minutes of meeting, basic reference for ESOC)29. RO-EST-RS-3001 Iss. 2.3 – Oct 03 - EID-A (this is the basic requirements documents ESA to Lander, signed; basic reference for ESOC)30. Generation and Distribution of the Lander Touch-Down Signal, RO-LAN-TN-3111-jb, Iss. 1/1, 18.06.99 (maybe outdated)31. S-D-L requirements (mainly towards Orbiter, for pre-separation and separation phase), inclusive risk assessment; J. Bossler, ca. 1999, draft

(maybe outdated, will be merged into new SDL Operations plan document)32. FDIR descent iss. 0.0, 1999.doc (started by J. Bossler; superseded by TN-3112)33. ROSETTA LANDER SDL Operation Plan Instruments Requirement Synthesis, iss. 0.0 by JF Fronton, 22.12.200834. Thermal Predictions for Descent and On-Comet Operations, RO-LTC-AN-3709, iss. 1, 06.06.200335. M. Hilchenbach (MPS) June/July 2003, Philae landing simulations report part I, II, III36. RO-DSS-RS-1034 ESS/Lander OBCPs URD, I1D, 04.10.200237. RO-DSS-RS-1052 Lander OBCPs URD I2, 04.12.2002 NEW: 38. RO-LAN-TP-3347a,b(--> -3417?), iss. 1.1, 30.07.2002 (G. Abt), Rosetta Lander S_D_L-Test (a On GRM, b On FM) 39. Sdl30_Timeline.xls this is the CDMS AMST 1000 as xls-Export40. Rosetta Lander: FDIR Failure Detection, Isolation and Recovery Analysis of the Separations-Descent-Landing Sequence (RO-LAN-TN-3112,

Iss. 1, 20.12.2000, prepared by G. Hummel)41. Biele, Jens; Ulamec, Stephan; Richter, Lutz; Knollenberg, Jörg; Kührt, Ekkehard; Möhlmann, Diedrich:THE PUTATIVE MECHANICAL

STRENGTH OF COMET SURFACE MATERIAL APPLIED TO LANDING ON A COMET, 58th International Astronautical Congress, 24-28 September 2007 / Hyderabad, India, IAC-07- A.3.5.03, Presentation and Paper


Science priorities during SDL for CDMS verification

Operational requests see table Proposed in last meeting (and in minutes) a

bit arbitrarily:

ROMAP, ROLIS and MUPUS were built for descent measurements Priority A.

SESAME, MUPUS-TM have good science rationale or vital calibration opportunity Priority B

All other requests may be considered not scientifically mandatory, will not be in core SDL test scenario (but in full test scenario)

Prioritisation to be confimed by SWT!

Decision needed by 1.April 2009

Instrument Sub-Instrument

Operation Priority

CIVA CIVA-P

Civa-P

Pan. Image after landing

Stereo image of OrbiterA

C

CONSERT Ranging 30 m , 1 Hz C

PTOLEMY MS Sniffing C

COSAC MS Sniffing C

SESAME CASSE

DIM

PP

Calibration, landing impact seismogramm

Dust fluxes

Electrical field

B

B

B

ROMAP MAG slow mode

Magnetic field A

ROLIS D DIT and DIS images A

MUPUS ANC

TM

Anchor acceleration & temp

Calibration

A

B


Actions SDL


Summary of Anchoring Sequence Discussion

Nota bene: Anchoring brake fails if soil weaker than (compressive strength) ca. 200 kPa! Since this is possible, we face the ripping of the anchor tether.

Tightening force: Decision to use level 1 (not level 0: if voltage is too low, motor may not move at all!) ~ 4 Newton instead of level 3 as foreseen up to now. Decision to use rewind counter = 240 cm (=criterion for safe anchoring).

Re-tighten later (AI to investigate autonomous procedure to stop if significant tether movement starts). The re-tightening as such after firing is unavoidable since hard-coded in FPGA.

2nd harpoon: at the moment, it is parameter-dependent whether it is fired unconditionally or not. If yes, 8 sec after 1st harpoon. That parameter, 8 sec, could be changed but has a number of implications (e.g., in hard soil, a shorter time is not sufficient to retighten tether completely, i.e. ANC will not know if safe anchoring with the first harpoon has occurred or not).


Anchoring – cont.-

We went through ANC flow diagram (from CDMS DDD V6.98) and hardware logic.It is noted that the only reason why the 2nd harpoon should be kept is the following: in very hard soil (ice), if the first harpoon penetrates only a few cm, over the course of the comets activity this layer might sublimate away and the first harpoon come loose. Then it would make sense to fire the second harpoon.Since it is now widely believed (see e.g. Biele et al., 2007) that the comet surface material is rather soft (kPa instead of MPa), this argument looses importance. Rather, firing the harpoons in quick succession would ensure that the ADS hold-down thrust (now a continuous thrust triggered by the TD signal, force ~ 17 N* exp (-t/9 sec)) will damp the rebound of the 2nd harpoon shot).Note: ADS SW needs to be patched to provide a continuous trust, triggered by TD signal. A patch test, to check patch procedure for ADS, is planned in PC10.


Summary of TD detection

Current status of discussion on TD detection:Sensitive LG accelerometer cannot be used to detect touchdown (TD) (perturbed by FW vibrations, does not integrate properly).Not-so-sensitive LG accelerometer cannot be used to detect touchdown (not sensitive enough for soft comet soil).LG bubble current and voltage signal would work in most cases, but then has no redundancy any more and could fail as well in very soft comet soil.A signal is needed by ROLIS, to stop imaging at TBC secs after the expected TDThe signal could be used by CDMS, to activate ADS and fire anchor(s) at TBC secs after the expected TD

Idea: use variation of bubble position provided by LG potentiometer (LG- HK) to detect TD. This has been proven (MPS tests) to be sensitive, but might lead to false-positive signals (either by elasticity of harness or by LG being hit by a big dust grain). Therefore, use only in possible time range (-uncertainty + calculated TD … + uncertainty + calculated TD) and do not fire ANC and ADS based on LG poti TD signal alone.New TD detection proposal (flow diagram) prepared by SU, see belowIssue: cover emergency release somehow! With emergency release, timing of predicted touchdown and its uncertainty, CDMS has no knowledge whether release was nominal or notDiscussion, whether SESAME/CASSE could support TD detection: trigger word to CDMS is in principle possible. S/W (to be written for PC12 earliest) would be in Sesame. H.-H. Fischer to analyze for (next) SDL_WG#3 , 28.4.09


Touchdown proposal 1

Tt*-ε Tt

*+ε

Arm:TDSPoti

TDS

Tt*

Fire:Harpoon

ADSInfo:

CDMS (ROLIS)

TDP

Info: CDMS

(ROLIS)

ContinueOn-Comet Ops

Info: CDMS

(ROLIS)

Fire:Harpoon

ADS

Time Time

AND

Time

Tt*...........calculated Touchdown Time

ε......uncertainty of Touchdown Time

Tt............................Touchdown Time

TDS....... Touchdown Signal (from LG)

TDP....... Touchdown signal generated by Potentiometer

Time


Touchdown proposal 2

Tt*-ε Tt

*+ε

Arm:TDSPoti

TDS

Tt*

Fire:Harpoon

ADSInfo:

CDMS (ROLIS)

TDP

Info: CDMS

(ROLIS)

ContinueOn-Comet Ops

Info: CDMS

(ROLIS)

Fire:Harpoon

ADS

Time Time

AND

Time

Tt*...........calculated Touchdown Time

ε......uncertainty of Touchdown Time

Tt............................Touchdown Time

TDS....... Touchdown Signal (from LG)

TDP....... Touchdown signal generated by Potentiometer

Time

AND


Harpoon Anchoring Device

Harpoon, accelerated by a

cartridge driven piston

into surface material and con-

nected by tensioned tether

to the Lander´s landing gear.

mass of unit: 400g

rewind velocity: 0.5 m/s

anchor velocity: 60 m/s

rewind force(TBC): 1...30 N

max. tether tension: 200 N

max. gas pressure: 250 bar

Tether length: 2.5 m


MM discussion summary

Possible scenario if one want to save the SDL data by all means after TD, for example to retransmit them to the Orbiter:1. Copy MM-RAM to MM-EEPROM. In this time (<= 40 sec) MM usage is not possible.2. Then establish RF link: MM-RAM content will be uplinked to Orbiter and emptied. At the same time the (new) real-time data are written into MM-RAM and transmitted at the end of the dump (FIFO). Still, all SDL data are stored in the MM-EEPROM (and can be re-transmitted as often as wished by copying into MM-RAM).(Size: each MM-RAM board and each MM-EEPROM board can store 8728 packets (~19 Mbit on Lander TM packet level).Operational constraint in this scenario: The RF link shall not be established until ‘uncertainty + calculated TD time + time for immediate post-TD operations + 40 sec to copy MM-RAM into MM-EEPROM’. This contradicts the present Philae link requirement to Orbiter.Another operational constraint might be that an item change or switch-off of MM needs to be excluded, since this triggers an “autosave” of MM to EEPROM, possibly overwriting precious data in EEPROM. Agenda-point for next meeting.


Mission analysis: to be analyzed – main points

New models and test cases

Effect of FW (nutation dynamics), rotation of Lander necessary?

Dispersion analysis update with sensitivity analysis

Study nominal release orbits with constraint that emergency release (0.18 m/s) still leads to a landing. Max. descent duration?

No ADS during descent preferred

dokumentname > 23.11.2004 sdl sequence: the system standpoint j. biele philae science team...

Documents

sdl sequence

sdl details

cologne sdl

core sdl

rttc sdl

sesame sdl

deadlines sdl

cdms sw sdl