Abstract
Eu:CROPIS is DLR’s first mission of the Compact Satellite Program. Its primary payload focuses on the research of closed-loop biological, regenerative life support systems, in a simulated gravitational environment of the Moon and Mars over months at a time. This is achieved by rotation of the satellite around its central body axis, using only magnetic torquers as actuators. A secondary payload (“PowerCells”) by the NASA Ames Research Center also utilizes the artificial gravity to conduct growth experiments on genetically modified organisms (GMOs). These payloads and the system design imposed constraints which affected the Assembly Integration and Verification (AIV) program in various ways and created challenges for the relatively small team to find solutions for. The paper to be presented will address the different aspects of the AIV program. This includes the verification of different critical components like the newly developed CFRP pressure vessel containing the primary payload and the Micrometeoroid and Debris Protection Shield, which protects it. Both items went through rigorous testing, including high-velocity impact tests, to ensure their reliability in orbit. Various other aspects concerning the biology had to be taken into account during AIV campaigns: due to the presence of degradable components within the primary payload, a late access capability had to be implemented in order to exchange biology as well as chemistry in cases of launch delays. To allow these operations as close as six months prior to launch, a highly flexible and streamlined acceptance test campaign was developed. A major impact on test planning and logistics was the fact that the secondary payload “PowerCells” contains GMOs, which European and German regulations restrict to be handled exclusively in especially certified laboratories (biosafety level 1 (BSL-1)). Thus, the use of external test facilities for the flight model campaign was not feasible as no European test center is certified to BSL-1. In consequence, the clean room facilities of the DLR Institute of Space Systems had to be certified to BSL-1 and new test infrastructure had to be procured in a short time frame to cover for acceptance testing. The design of the satellite and nature of the attitude control subsystem required limits on the magnetic momentum of the system and every unit it contains. A test flow incorporating the magnetic property measurement of each unit and a final system-level test in an external facility had to be devised, which enabled budgeting and projection of expected measurement results on the system level. Furthermore, the moments of inertia had to be measured precisely in order to have a stable spinning axis enabling a stable gravity simulation. Finally, the functionality had to be verified for each unit and for the system which required that several small test campaigns had to be conducted, like a solar panel deployment test and extensive software testing. A tight link to the operations teams of the German Space Operations and Control Center during such tests and beyond finally ensures the operability of the overall system in the operational phase.
1. Introduction
Eu:CROPIS is the first satellite of the German Aerospace Center’s (DLR) Compact Satellite Program and is developed by the DLR Institute of Space Systems in Bremen. The platform is designed for a specific purpose that is defined by its primary payload. The first mission carries the name-giving payload Eu:CROPIS, a spin-stabilized small satellite that will be operated for two years in a sun-synchronous orbit. Eu:CROPIS has been launched on December 3rd in 2018 on top of a Falcon 9 launcher in the frame of the Spaceflight Industries SSO-A mission. It was placed into a circular Sun synchrounous orbit with an altitude around ~580 km and an inclination of 97.8 deg. More details about the spacecraft setup can be found in the system overview of reference [1].
Eu:CROPIS will carry, among others, a coupled biological life support system. The spin-stabilized satellite platform will provide artificial gravity to its payloads and thus simulate lunar gravity conditions during the first six months of the mission, followed by six months with increased spin rate resulting in Martian conditions. Reliable life support systems are indispensable for any long-term space exploration, being on board a space craft or in habitats on the Moon or Mars. Since it is virtually impossible to support a crew with sufficient oxygen, food, and water for an entire long-term mission, everything necessary for life has to be recycled. Eu:CROPIS is a testbed for a combination of two different life support systems, a physiochemical (PCLSS) and a biological system [2–5] that will support tomato plants in two greenhouses from seed to seed.
The first of two systems is a biological trickle filter that will convert synthetic urea into a fertilizer [6, 7] while the second system, consisting in particular of a single cell flagellate culture called Euglena gracilis, will detoxify the overall system and protect the plants against high ammonia levels [8–10] The plants in the greenhouses will serve as a bioindicator and shall demonstrate the stability and overall performance of the system [11].
The primary payload (Figure 1) is developed by the DLR Institute of Aerospace Medicine in Cologne and the Friedrich-Alexander-Universität Erlangen-Nürnberg; the overall project management, spacecraft development, overall system assembly, integration, and test have been done at the Institute of Space Systems in Bremen.
Eu:CROPIS carries another biological payload provided by the NASA Ames Research Center. This secondary payload is called PowerCells and contains a set of genetically modified organisms (GMOs) in two compartments. PowerCells main goal is to investigate the performance of microbial mini-ecologies containing photosynthetic microbes and consumer organisms, to conduct synthetic biology remotely in space, and to test protein production at different gravity levels [12]. RAMIS (RAdiation Measurements In Space [13]) and SCORE (SCalable On-boaRd computer [14]) complete the four payloads of Eu:CROPIS.
Eu:CROPIS in launch configuration has dimensions of approximately and (Figure 2) after deployment of the four solar panels. The wet mass of the satellite is 234 kg. The space craft is separated into two main structural assemblies to enable simultaneous integration activities: the bus section containing most of the avionics and the Micrometeoroid and Debris Protection Shield (MDPS) sections. After integration of the primary payload, both sections are merged.
2. Assembly, Integration, and Verification Campaign
2.1. Challenges and Constraints
The primary challenge of this mission was to coordinate the biological lifespan of the payload agents with the launch window dictated by the chosen rideshare option, as well as the handling of genetically modified organisms in a standard space engineering environment, using standard methodologies, infrastructure, and tools.
Rideshare missions are generally complex in the coordination of a vast number of paying customers and payloads, thus suffering from a high probability of launch delays. In the case of Eu:CROPIS, the total accumulated launch delay summed up to 18 months in total over the course of the AIV campaign. The lifespan of the biological agents used in both payloads Eu:CROPIS and PowerCells are estimated to be limited to approximately six months in total until an exchange of microorganisms and chemistry becomes necessary. This reduces the campaign time to a maximum of five months from payload integration to rollout and requires strategies for an exchange of payload biology.
The handling of genetically modified organisms, as in the PowerCells payload, is strictly regulated by European and German laws, limiting the operations to certified laboratories with biosafety level 1 (BSL-1). This impacts both spacecraft integration and spacecraft testing, when external test facilities are contracted. Ground operations with biological agents furthermore require a narrow temperature limit to be maintained during all logistics processes.
The magnetic ACS of the spacecraft was identified to be a major design driver for the FM development and verification. A defined magnetic cleanliness of the spacecraft structure had to be achieved to guarantee the necessary rotational stability along the central body axis to establish defined acceleration levels for the payloads. The difficulty to simulate magnetic interactions in complex systems made it necessary to define a detailed test approach on the system and subsystem levels to comply with the associated requirements.
2.2. AIV Schedule
The Eu:CROPIS AIV schedule is driven by the launch window of the rideshare mission as well as by the lifespan of the biological agents and chemistry integrated in the payloads. The initial launch window envisaged for the SSO-A rideshare mission was Q3/2017, with the actual launch taking place on Dec. 3rd, 2018, leading to an overall launch delay of approximately 18 months. An overview over the project milestones is given in Figure 3.
The FM campaign started at Q3/2016 after CDR and reached acceptance test readiness after the flight biology integration in Q1/2017. Due to the biological lifespan, the acceptance test campaign had to be kept synchronized with a biology exchange within the launch delay. The time for exchange and final acceptance has been estimated to last three months.
Due to a series of launch delays starting in Q2/2017, only the acceptance tests booked at external facilities have been conducted to allow biology exchange operations later on. The overall launch delay of 18 months caused two additional biology exchange operations. The next envisaged exchange would have been due in late December 2018. In total, the project schedule has been on biology exchange standby for almost two years due to the unclear launch manifest, stressing both project budget and team availability. The additional time was used to perform additional software and functional testing to optimize the spacecraft functional performance. Figure 4 shows the final status of the AIV schedule (additional bio exchanges not included.
2.3. Model Philosophy
For the Eu:CROPIS satellite, most of the subsystems are provided as qualified units by other suppliers. The payloads are treated as qualified delivery items as well. Since the structure is a new development fitted to the mission envelope, a hybrid model philosophy (Figure 5) is chosen comprising two production models (structural model (SM), flight model (FM)) and one avionics testbed (engineering model (EM)).
The mechanical and functional verification on the qualification level will be done on the spacecraft structural model (SM). Furthermore, the SM serves as the testbed environment for optimization, training, and process adaption: (i)System handling (fit checks, GSE)(ii)Integration flow and integration processes (fasteners, gluing, drilling, riveting, etc.)(iii)Optimization of the harness routing(iv)Designing of necessary jigs and tools for FM integration(v)Operator training(vi)Test facility and methodology evaluation(vii)FM integration and test procedure optimization
With the SM campaign completion, the procurement time of the FM components is used to optimize the FM integration flow, further develop processes, and design new tools. Furthermore, all operators and subsystem engineers received a suitable level of hands-on training, drastically speeding up the FM operations and enhancing quality. The structural model is used as the Spacecraft Mass Dummy (SMD) after FM acceptance review.
The functional performance qualification is done on an engineering model, operated as an avionics testbed (“FlatSat”). After the EM functional test campaign, it was used for functional unit tests during the FM campaign. After launch, the avionics testbed has become the Ground Reference Model (GRM) and is used to verify flight operation procedures. Due to this transition, the EM had to be designed to be as compact as possible to be held available during the mission operation time without wasting space in the facilities.
The flight model (FM) saw tests at the acceptance level to find integration process-induced workmanship errors and to validate launcher requirements.
2.4. Assembly, Integration, and Verification Strategy
The AIV strategy of an institutional scientific satellite mission is usually strictly limited in budget and headcount, while a rideshare launch defines the launch window. Furthermore, a high flexibility in component design, manufacturing approaches, and testing has to be maintained for budgetary reasons. Listed below are the major drivers for the AIV campaign. (i)Project (1)Tight schedule for implementation after phase B(2)Mission time max two years in orbit(3)Budget limited to ~15M€ (space segment)(4)Small, highly integrated team(5)Rideshare launch opportunity(ii)Technology (1)Payload-driven projects: few off-the-shelf components(2)Prototype spacecraft: flexible verification methods(3)Model philosophy limited by budget(iii)Mission specifics (1)Genetically modified organisms(2)Lifetime of biological and chemical agents
The DLR Compact Satellite Program offers the opportunity to implement and test new approaches in the AIV process, which are tailored towards the realization of compact class science missions with the abovementioned restrictions. Since all stakeholders are based in-house, no prime substructure is to be maintained during the project. This circumstance allows deviations from the standard project management concepts seen in larger space programs.
The production of a spacecraft consists of two interlocking fields: (a)Production methodology(b)Verification program
Both fields are subject to examination within the Compact Satellite Program.
2.4.1. System Production Methodology
For the first mission of the Compact Satellite Program, the overall goal of the AIV campaign was to reduce the necessary costs and time for the spacecraft integration and verification phase, resulting in additional development time for the all subsystems. To achieve these goals, it is necessary to analyse the assets provided by the organization of DLR and the associated institutes, to make the best use of the available resources. The major benefits in the project are: (i)diversified in-house department structure (system engineering, avionics, GNC, testing)(ii)flat hierarchies(iii)small teams with high dedication and expertise(iv)in-house production (clean room, electronics lab)(v)in-house testing (vibration, shock, and thermal/vacuum)(vi)close connection to ground segment (GSOC)
To realize a project in the defined time- and cost frame with a small team and limited infrastructure, it is necessary to define an agreed production methodology within all stakeholders. To stick to schedule and comply to all PA requirements, it is vital to keep the balance between “institutional chaos,” which is often seen within research-oriented organizations, and “industrial overkill,” coming with the implementation of large-scale project methodologies in small-scale projects, as seen in the industrial environment.
To make use of the assets and get along with the described restrictions, two major fields of optimization have been identified: (a)Production philosophy(b)Applicability and implementation of standards
The first covers the overall implementation of the work environment and PA coverage; the second describes how existing standards are adapted and modified to fit the project specifics and scale.
2.4.2. Production Philosophy
For the Eu:CROPIS project, it was decided to take a lean production approach, in this case the Toyota Production System (TPS), and tailor its philosophy for prototype development. The goals are to generate a work environment that allows maximum quality, productivity, and adherence to schedule.
Three branches are identified to be most promising for productivity improvement: production logistics, product assurance-driven processes, and workplace management.
(1) Production Logistics. To optimize production logistics during integration, a just-in-sequence method is used in combination with a structured cell production, projecting a large-scale pull-Kanban system to the three-model philosophy described above.
For this instance, the sequence of integration of the spacecraft is fragmented into three autonomous compartments, which are integrated in identically equipped production cells (Figure 6). For each cell, a maximum of two AIV operators and one subsystem engineer are allowed to reduce disturbances in all cells. This methodology has several assets: the interchangeability of tools between cells; flexibility in the order of compartment integration, which helps to compensate for delays caused by suppliers and nonconformances; and parallelization of work to speed up the integration process. This is backed by the fundamental idea of the TPS, which is to eliminate waste wherever possible.
(2) PA-Driven Processes. The PA-driven process design includes the standardization of tools and usage of defined, reviewed, and optimized processes for the operations as well as for work preparation. The processes have to be balanced between reproducibility (PA approach required) and flexibility (prototype approach required), to allow quick adaption to unexpected problems during integration and test of a system. This is implemented by a flexible, standardized system of integration procedures, using a checklist-type design rather than a sequential work instruction.
Staged checklist-type procedure design allows free modifications during the integration and test process by the AIV team. This method is a compromise between the mentioned, allowing higher speeds during integration and tests by giving the AIV teams more freedom with the operations, while enabling comprehensive process documentation. Furthermore, it is vital for this kind of project to implement a positive culture of error and to back this culture with quick and responsive nonconformance handling (NRBs, corrective actions, strict avoidance of finger-pointing). Furthermore, the constant review of the operational processes by both PA and AIV and quick adaption of improvements (Continuous Improvement Process) are used to optimize operability. A quick reaction time to occurring problems is a key capability of small, highly integrated teams and thus a major asset for the project. This reduction in quality-driven workflow interruptions helped to increase the ratio of value-generating processes to over 66% while maintaining a very high workmanship standard with only four workmanship-caused minor nonconformances during the FM campaign.
(3) Workplace Management. Since communication problems within the project team can be identified as a major cost driver during the phase C/D of a project, a special focus has been laid on the work structuring during the campaigns. To avoid the disconnection between subsystems, system engineering, and AIV and to foster direct communication on an agreed and understood basis, mixed teams of AIV- and subsystem engineers have been introduced during integration (philosophy: “you designed it, you integrate it”). This structure shortens the feedback time for the subsystems in the development phase and makes it possible to quickly implement changes in the design of the following models. In addition, the AIV team is empowered to take over a lot more PA responsibility, which improves the overall quality of work while reducing the PA workload. Furthermore, it enhances the work dedication of the team members through trust and drastically reduces the amount of unproductive manpower (PA officer as bystander during integration steps). During the project phases, it has been seen that this kind of work environment philosophy has to be actively implemented, lived, and fostered by the project management and system engineering to generate the necessary acceptance amongst the team. Once implemented, these methods directly enhance the productivity and employee satisfaction through all hierarchy levels.
2.4.3. Standards and Processes
The ECSS and all related space standards are designed for the management of large projects, in the frame of several tens of M€ and above, looking for long space segment lifespans and harsh environments, such as deep space, while scattering development from an institutional customer over an industrial primary contractor to several subcontractors.
For small institutional compact satellite projects with mission times of less than two years in orbit, it is not feasible to implement a full ECSS approach on all levels, since the resulting paperwork is not manageable by a small team. Furthermore, an institutional mission is able to accept higher risks than a mission with an industrial primary contractor, allowing more flexibility in the standardization and process control.
Since the direct communication between subsystems is fostered through the described methods within the project structure, the documentation can be reduced to the necessary minimum while strictly avoiding information mirroring. To reduce the effort, the ECSS has been tailored to match the project size without giving up the benefits from the experience provided. This is achieved by both reviewing and picking out the promising production methods, defining acceptable parameters for COTS, and reducing the amount of ECSS-required documentation by merging of documents.
2.5. System Verification Program
The overall verification strategy of the Eu:CROPIS project is based on a standard ECSS approach, tailored down to the mission specifics. The verification methods used are review of design, analysis, inspection, and test, applied on the system domains structure, EMC, thermal, cleanliness and contamination control, model build standard, and ground operations. This includes the usage of three spacecraft models (see Model Philosophy) and the verification stages qualification and acceptance.
The requirements covered by RoD are considered to be validated during the milestone reviews (PDR, CDR, and AR). Analyses are carried out in the field of the respective subsystem or on the system level. Inspections are system level activities. Tests are used on both the subsystem and system levels.
The qualification campaign (Figure 7) follows a nominal verification sequence approach. After the SM integration, the test flow follows the load application as seen during launch and early operations. In parallel, the EM is used for software development and functional verification of the subsystems, while building and testing the space-to-ground infrastructure with the German Space Operations Center (GSOC), which is responsible for the spacecraft operations.
Due to the biosafety level of the mission, all system-related environmental and mechanical functional testing of the FM was subject to restrictions regarding access, handling, and transportation, which denied contracting external test facilities. To compensate for this, the test facilities at the DLR Institute of Space Systems were upgraded to allow testing of compact class spacecraft, while the cleanrooms had to be classified as biosafety laboratories. As a side effect, the project experienced a significant speed up during the acceptance test campaign, for instance, reducing the total time for the structural verification from three and a half weeks (SM) to two weeks (FM) in total. The restrictions from biodegradation and launch delays as well as BSL-1 needed several alterations in the nominal test flow to the one shown in Figure 8. Thermal balance had to be performed first, to evaluate flaws in the thermal design prior to flight biology integration. Since the thermal balance configuration is very close to the flight configuration, an intermediate MPM test had been performed to determine the trimming strategy for the spin stabilization. After TRR, the external magnetic field test was performed, using the IABG MFSA (Magnetfeldsimulationsanlage (Magnetic Field Simulation Facility)) followed by the TVC with the same rationale as for the Thermal Balance Test. After the external and thermally critical tests, the payload compartments containing flight biology have been integrated. This makes the spacecraft FM a BSL-1 item with all given restrictions. Since shortly after the phase A late access, a major launch delay has been announced and the ATC has been focused on an elongated function end-to-end test and ground operation training. To maintain the functionality of the biological and chemical agents, a second late access (phase B) had to be performed, again followed by a launch delay announcement. It was assumed that the second launch delay would stay well below the critical six months deadline, so the ATC could be resumed with the mechanical verification (deployment, vibration testing). This was accompanied by a preflight maintenance phase to bridge the schedule gap induced by the final launch delay. The FM acceptance is closed by a full orbit simulation under vacuum in the solar simulation vacuum chamber at the DLR Institute of Space Systems to validate both system autonomy and the command and telemetry chain from spacecraft to ground segment. In parallel to the FM ATC, the EM and ground segment facilities were involved in constant flight software verification and the definition of all ground operation sequences, resulting in the Mission Information Base and the Space System User Manual as the baseline for the spacecraft operations.
One focus for the verification was to use end-to-end test scenarios as early as possible to gain experience with the spacecraft behavior and to identify possible design flaws caused by system interactions, with the goal to reduce cost impact in later project phases. This was started after the SM campaign by combining EM and SM components for different test setups (e.g., panel deployment). To keep cost control during testing, the Pareto principle was projected to the test setups: almost all critical malfunctions to be encountered in orbit can be found even with a less representative test setup.
3. Product Assurance Strategy
Product assurance (PA) is strongly incorporated in the project lifecycle of Eu:CROPIS. Within all phases, risk management is ensured by PA and followed together with project management and the complete ground operations and satellite team. Potential risk conditions are identified, addressed, and controlled in order to maximise the probability of program success by anticipating possible problems, identifying opportunities, and taking cost/time effective actions. Besides that, dependability design principles are involved by PA so that the maximum project success expectance is achieved.
Especially in phases of hardware assembly, integration and test quality assurance activities take place like inspections and traceability management. Traceability in the form of configuration control is implemented within documentation and hardware processes. Anomalies, defects, damage, or unforeseen discrepancies between documentation and the actual hard- or software are documented and tracked by nonconformance reports (NCRs). Those are reported from persons detecting the problems and get processed in dedicated nonconformance review boards (NRBs) with all involved responsible persons.
PA reviews (i.e., manufacturing readiness review and test reviews) shall help to inquire if processes are adequately prepared or documented and can survey residual nonconformances which occurred during preparations/tests. During posttest reviews, necessary retests are defined and an overall assessment of the test success is made and documented.
Moreover, one PA task is to control safety risks and hazards. In early design development states, no dedicated requirements for the Eu:CROPIS project related to safety or to space debris were known. The launcher options or at least the launcher specifications/ICDs were not yet defined. Especially without safety specifications, the safety documentation of the design was very unspecific due to the uncertainties. But a standardized safety data package describing the safety-related design and standard possible hazards for equipment, personnel, and launcher was established in general. Later when launcher safety regulations became clear, the whole safety documentation needed to be revised. The form and content was adapted to launch provider templates. The safety design of the spacecraft of the Eu:CROPIS mission has to be validated against requirements from the Air Force Space Command Manual (AFSPCMAN 91-710) insofar as the launch is provided by SpaceX from the military Vandenberg Air Force Base (VAFB). The compliance to that air force standard has to be documented in a compliance matrix which is supplied to the launch provider Spaceflight Industries. The safety design description requested within AFSPCMAN is a dedicated document called Missile System Prelaunch Safety Package. It is established from the PA manager with inputs from the subsystem engineers between phases C and D.
In terms of space debris mitigation, first, a general space debris mitigation plan was established in phase B. The document analyses the Eu:CROPIS design against many known standards [15–18] and a DLR internal standard [19]. The applicable regulation describing space debris mitigation was not communicated at that time. The topic of space debris was touched from the launch provider once in a face-to-face meeting, but no document was requested upon shortly before launch. It is anticipated that if space debris mitigation documentation is requested for Eu:CROPIS and the launch is from VAFB, the regulations from NASA-STD-8719.14A would have become applicable.
For the spin-stabilized Eu:CROPIS satellite, the material choice must reflect magnetic characteristics of selected materials. Due to the AOCS being based on magnetic torquers, the magnetic material needs to be reduced to a minimum (as the overall magnetic budget must stay below a defined value). Especially for the fastener material choice, this aspect is a complex topic to be coordinated by PA. First, the fasteners have to fulfil all material and integrity requirements for structural integrity and safety reasons. But further also, the reduced magnetic characteristic requirement is valid for the fasteners. Discussions were coordinated between AIV, structure work package, AOCS engineers, and PA. The trade-offs are assisted by material analysis in the form of research in technical datasheets and chemical properties. All unit Declared Material Lists (DMLs) are reviewed by PA analysing for possible soft or hard magnetic material next to outgassing and unsuitable space materials. There are multiple NCRs listed related to magnetic occurrences/anomalies. Three NCRs in the early unit integration phase deal with the report of magnetic materials used inside the satellite platform or for structural model (SM) bolts or payload connector screws. These problems occurred even though requirements for limited usage of magnetic material are defined within the project’s common unit specification. Since these findings were detected early in the SM hardware phase, it was possible to communicate and replace the violating materials. But next to those nonconformances concerning magnetic properties in used materials, there is also one major problem reported wherein the satellite shows an induced magnetic phenomenon which was detected in a magnetic field measurement (MFM) campaign with the flight model (FM). Difficulties within the MFM were that the FM satellite was not in final configuration. Payload units needed to be replaced in a later late access (e.g., for biological material exchange). This aspect makes the results not completely valid for the final FM configuration. Two components were found to be the source of the possible induced magnetic field during MFM. They were detected during the NCR failure analysis by disassembling and investigating single parts within the suspicious units, i.e., by tests with permanent magnets. A variable offset is still expected to be seen in the magnetometer measurements related to this reported NCR. The offset and possible corrective actions in terms of in-orbit recalibration are discussed, documented, and communicated as a residual project risk and later accepted by the AOCS engineer and project management.
4. Assembly and Integration Approach
Since all subsystems and payloads are delivery items, no assembly on the subsystem level has been performed by the system AIV team. For the integration activities on the system level, a flexible just-in-sequence integration flow has been designed.
The mechanical end item integration is done in parallel in the production cells 1 and 2, which hold the respective MGSEs for bus and MDPS integration (see Figure 9). Colocation enables quick mating and demating processes during late access. Cell 3/ATB holds the avionics testbed and is used for FM equipment functional checkouts prior integration. Furthermore, the cell holds the Electrical Ground Support Equipment (EGSE) and TMTC equipment.
After integration of the system compartments, the structure mating and solar array integration is done in cell 1 on the spacecraft system Mechanical Ground Support Equipment (MGSE).
All mechanical GSEs are unique designs fitted to the purpose using off-the-shelf construction profile systems and polymer 3D printing. This allows a quick flexible adaption to the changing design specifics during SM and FM campaigns but also slows down the integration process, since there are no fixed MGSE constraints in the early project phases. This leads to an increased workload during the AIV campaigns in order to optimize the MGSEs while spacecraft integration is moving on. The MGSE concept design has been identified to be a major cost and schedule driver during the project phases C and D and will be subject to optimization in follow-on projects. Nevertheless, the combined use of standard size construction profiles and 3D printing proved to be a feasible and quick method of MGSE manufacturing, which can be easily implemented without the need of a large-scale machine shop or external suppliers.
4.1. Thermal Verification
The thermal verification approach of the Eu:CROPIS spacecraft utilizes a bottom-up approach with a broad end-to-end test spectrum rather than development testing. Again, all subsystems are treated as delivery items that have been acceptance tested with the standard ECSS approach prior delivery.
The Eu:CROPIS TCS is a passive, heater-backed radiator setup making use of the spacecraft orientation towards the sun. The main heat sources (bus and primary PL) are directly connected to the radiator surface via conductive paths. The radiator itself consists of a tape-based second surface mirror which covers the spacecraft bus compartment cylinder wall.
In order to save time and costs in early phase C, only a minimalistic and idealized structural thermal model was built to simulate the thermal characteristics of the main conduction path. A Thermal Balance Test (TBT) was performed on this setup (Figure 10) to validate the Thermal-Mathematical Model (TMM) and to size the radiator.
All thermal tests following the reduced TBT also served as FM functional end-to-end tests for subsystems, software, and operations, allowing integrated system verification during all system tests (test what you fly, fly what you test). The thermal verification consists of three test campaigns described in short hereafter. The tests gradually increased understanding of the system thermal behavior and delivered inputs for the software development both on the system and payload levels.
4.1.1. System Thermal Balance Test (FM)
The TBT is an equilibrium test for hot and cold case determination, radiator trimming, and long-term standalone operation in safe and science modes. The test was done in the middle of the FM integration campaign, since the radiator is no longer accessible once the solar panels are integrated and a test on flight biology was seen as too risky. The general test restriction is the temperature of the two controlling primary payload TRPs, which shall guarantee a payload water temperature in an interval of +5°C to +30°C. This is seen as the sizing temperature range of the spacecraft. The spacecraft safe mode in eclipse is defined as the cold case with minimum power emission of the bus components and safety heater activation of the payloads. The hot case is the science mode in direct sunlight with the spacecraft spin axis at 0° sun angle. The spacecraft is controlled with the same ground segment setup as is used during LEOP to guarantee a close-to-reality end-to-end simulation. Since the system maintained a payload water temperature of 8.7°C, despite a control TRP reading of 4.85°C, the thermal concept is seen as qualified without need for changes in radiator size (Figure 11). Dedicated FDIR testing was not foreseen.
4.1.2. System Thermal Vacuum Test (FM)
The TVC is a hot and cold case switch-on, system characterization, and heater performance test. Furthermore, the operational commands are verified as preparation for the safe mode and the test serves as operator training. The spacecraft is installed on the DLR-RY thermal vacuum chamber Kronstein and sees an average thermal environment for sunlight and eclipse as used for the TBT. The test was done at the end of the FM integration campaign, since a test on flight biology was seen as too risky. The general test restriction is again the temperature of the two piloting primary payload TRPs, which control the shroud and Kronstein to a minimum limit of 5°C and a maximum limit of 30°C. In total, three cycles are performed. The system showed a similar behavior as in the TBT and performed well during the switch-on (Figure 12); the switch-on points can be clearly identified in the graph. Again, the test is performed using the EGSE setup, ground segment infrastructure, and control environment as used for spacecraft ground control to actively train the spacecraft handling in a realistic environment. Since the focus was set to the thermal verification, no dedicated standalone FDIR testing has been foreseen.
4.1.3. Orbit Simulation Test
The OST is a test for the autonomous operations both in safe and nominal modes (at 48 hr) under orbit conditions (cold wall, solar simulator, 62 min illumination, and 35 min eclipse) and serves as payload operation training. The test is described in detail in End-to-End Testing: Orbit Simulation Test.
4.2. Mechanical Verification
The mechanical verification of the Eu:CROPIS satellite structures had several challenges. Some of them are not unusual in their kind but rather in their extent like the load levels for qualification. Others are very unique to the Eu:CROPIS project like the need for a biosafety level 1-approved shaker lab or the need for a pressurized housing with very strict requirements regarding the leak rate [20].
The preliminary load requirements had acceleration levels which are quiet unusual for a satellite of more than 200 kg.
Random test loads for qualification exceeded 11 gRMS. Even though the satellite structure was designed to withstand these loads, a very careful approach was taking during qualification vibration testing. Tests were sorted by raising the stress level and thus failure probability to make sure to gather as much data as possible in case of a failure during the more demanding tests. The tests were sorted as follows: (i)Resonance survey and -18 dB random vibration in 3 axes(ii)Sine burst test in 3 axes(iii)Random vibration in 2 axes
The resonance surveys were to confirm the frequency requirement of 35 Hz [21] and to have a reference for the following load tests. The approach to check the resonances in all three axes before putting significant stresses on the structure was also followed for the flight model acceptance campaign.
The -18 dB random vibration runs were to confirm the notching strategy derived from the resonance survey. Notching was done at resonances of high gain. This was done manually to the input spectrum. In addition, an autonotch was set to some acceleration sensors to secure the structure in case of nonlinear behavior at higher load levels.
Each load test—sine burst and random vibration—was followed by a resonance survey to check for changes in stiffness and thus structural failure.
Therefore, the satellite had to be moved 6 times to change the load axes.
Furthermore, the structural model was equipped with 19 acceleration sensors (1 or 3 axes) adding up to 39 acceleration channels. This was to provide the different units within the satellite with improved load data for testing on the unit level.
While the many changes in load axes are complex and time consuming—especially with the high number of channels—they proved very useful. During the very last test run, one of the more complex mass dummies had a structural failure. Due to the high number of channels and the previously collected resonance data, it was possible to identify the position of the failure in the model without opening. And due to the sorting by test load level, the full test program could be performed without a reintegration of the structural model [22].
Launch load requirements were strongly reduced for the acceptance campaign (Figure 13) as further analysis was done by the launch provider. Only at a few frequency ranges was the new environment more demanding than the one qualified against. This required a notching similar to the one used at the qualification test campaign. This required an acceleration sensor within the satellite to control the autonotch. This sensor is not accessible after the integration and thus had to stay in the satellite for flight.
4.2.1. Mass Property Verification
As the biological payloads require a low gravitational gradient, satellite mass properties have to be known as exactly as possible. This implies knowledge of (i)major and minor moments of inertia(ii)deviation moments(iii)angle between centroid axis and structural coordinate frame(iv)mass and centre of mass
The first mass property measurement was performed in late phase B using the structural model. An adapter of roughly the same mass as Eu:CROPIS had to be used for and mass property determination. This resulted into too high measurement uncertainties, so it was not possible to state if requirements were met or not. Due to the high measurement uncertainties, vibration test harness modelling, and harness and fastener representation in the CAD model, test results differ to CAD analysis results in terms of CoG, MoI, and centroid axis. For example, the angle difference between centroid axis and the structural coordinate frame -axis of CAD analysis and test results is 6.8°. Test results showed also the need for mass property trimming. At that time, the flight model structure was already in production and design changes were not possible anymore. First flight units arrived and their mass differs to their latest ICD version. Also, CAD data was not available from all units. To encounter all these challenges, the following measures were taken: (i)Comprehensive refinement of the CAD model(ii)Mass property mathematical model(iii)Search for possible trim mass locations(iv)Search for a test center which meets the high measurement accuracy and biosafety level 1 requirements(v)Three mass property measurements at different integration states
The refinement of the flight model CAD included also the very detailed modelling of harness components and fasteners. The CAD model evolved with every flight unit delivery. A dedicated mass property mathematical model was set up in MATLAB to examine which trim measures were necessary to satisfy AOCS, launcher, and payload requirements. A comprehensive search for possible trim mass locations was performed considering a late access possibility. Possible locations had to be agreed with structure subsystem engineers as no additional stiffening structure could be introduced. Nine trim mass locations had been identified and also a rotation of the heave primary payload was performed. A test company was found which can deal with the high accuracy requirements and performs measurements within customer’s facilities, so biosafety level 1 was not an issue anymore as the integration lab at DLR Bremen was already BSL-1 certified. A three-phase mass property measurement campaign was established to meet possible discrepancies between analysis and test data, to cover different integration states, and also to enable changes of the trimming strategy (Figures 14 and 15).
The mathematical model was refined after each test; mass property analyses were rerun to check if chosen trimming measures are still ok. After the last mass property measurement, in which also the solar panels had been tested standalone, all possible satellite configurations were calculated. Measurement results and postprocessing analyses confirmed that AOCS, launcher, and payload requirements were met. So the taken measures performed well.
4.3. Magnetics and EMC
Driven by requirements from the purely magnetic Attitude and Orbit Control System (AOCS) of Eu:CROPIS [23], the electromagnetic conductivity (EMC) verification is implemented as a three-stage process to cover effects induced by electromagnetics and remnant magnetic moments.
Since a detailed analysis of the magnetic behavior of the spacecraft is not feasible, it has been decided to perform measurements of the remnant magnetic field of the major units after their delivery during their incoming inspection. The resulting dipole values can then be added to gain the worst case estimation of the spacecraft remnant magnetic field and to implement design changes, such as trimming magnets, if necessary.
The challenging aspect was to manage a magnetic budget. The magnetic budget is required to ensure that the residual magnetic dipole of the spacecraft stays below a threshold magnitude of 1.5 Am2 for the overall spacecraft. This requirement is directly imposed by the AOCS performance.
To approach this problem, it is very important to already address it in a very early design stage and make it “visible” to all engineering personal, even if they are not familiar with magnetic design and do not have access to precise magnetometers. Some tiny whiteboard magnets were distributed to bring this issue into mind and set the informal requirement: “If this magnet sticks to something, it is not allowed inside the S/C.” The repetition of this procedure at every major review meeting ensured that the magnetic issue was recognized by everybody and allows a very simple check for magnetic cleanliness.
Before measuring any magnetic dipole, these tiny magnets already allowed to figure out some unintended material combinations during structural model setup, e.g., some nuts and bolts. In addition, this informal requirement had the result that nearly every subsystem was confirming their design at very early design stages with the EMC and AOCS engineers.
The EMC and AOCS engineers were often able to provide hints and design rules on how to change a specific design such that it became acceptable. One example here is the arrangement and usage of liquid pumps, with pairwise coreless motors as pump drivers. The coreless motors have a defined static external magnetic field. By placing two motors beside each other and orienting those in such a way that their magnetic fields compensate, their overall magnetic dipole could be drastically reduced.
Table 1 shows the magnetic budget that was assembled from the magnetically most relevant components. The dipole values were measured and estimated at incoming inspection of the specific component.
As comparison to the requirement, the total sum and the root sum square where used, in which both stayed well below the requirements.
Finally, a system magnetic verification was executed at Industrieanlagen-Betriebsgesellschaft mbH, Germany (IABG), which revealed a residual magnetic dipole of ~0.4 Am2. Figure 16 shows the Eu:CROPIS satellite within a large Helmholtz coil setup at IABG. The final measured dipole was well below the required one and shows that a tight interaction between the subsystem engineers and a simple board magnet were very helpful tools. The value was even below the estimated values from the magnetic budget, which shows that taking measurements at the component level is a proper approach for magnetic budget maintenance.
4.4. Software and Functional Verification
The challenges during functional verification were primarily on the schedule side. The time given for setting up the system engineering model (FlatSat) and conducting tests on it was limited by the time available after completion and before system flight model integration. The FlatSat integration campaign lasted seven months including delays induced by postponed delivery of individual units, sometimes due to inconsistencies in the definition and implementation of interfaces. It proved to be of great value to verify every EM unit’s interface on the FlatSat, before approving the production of the respective FM unit. Upon arrival of a FM unit, it was put to stand-alone and integrated testing in the FlatSat, being exchanged for the respective EM unit. This pretest was chosen to be implemented in order to optimize the time required for testing on the system flight model, which otherwise could only be fully executed, once all three segments, the bus segment, the payload pressure vessel, and the MDPS, were fully integrated and interconnected.
The overall verification flow for each unit incorporated furthermore the characterization of its static magnetic properties in order to allow for magnetic budgeting of the overall system. This was done in-house and enabled us to evaluate the quality of the magnetic cleanliness of the system flight model before the system magnetic characterization took place. This was necessary because of the magnetic attitude control subsystem of Eu:CROPIS.
The software development and verification effort was supported by the availability of various hardware models. In the early phase of software development, a DLR-internal generic OBC hardware model (Office Model (OM)) was used to create the hardware-independent functionalities. This was then augmented by the availability of a functional-equivalent CDH Software Development Model (SDM) provided by the CDH unit manufacturer and enabled the development and verification of the bootloader. Once the FlatSat became available for software verification, it opened enabled verification of almost all functions and was fully supported on the system FM.
The FlatSat and the system FM were also utilized to verify flight operation procedures (FOPs) together with the GSOC operation team. The availability of mainly the FlatSat enabled the operation teams to train on a functionally flight-like model and transport the lessons learned from other missions to Eu:CROPIS in order to prepare for a smooth transition to the operation phase.
4.5. End-to-End Testing: Orbit Simulation Test
The System Orbit Simulation Test was part of the Eu:CROPIS FM campaign and served as a thermal functionality test for the fully integrated and flight-ready FM. The system is operated for (32 orbits each) in the acquisition and nominal modes with stored solar arrays under orbit conditions where it shall show its operability in the dynamic thermal equilibrium of the Launch and Early Operations Phase (LEOP). To simulate the environmental conditions, the Eu:CROPIS flight model is set up inside the DLR-RY thermal vacuum and orbit simulation chamber (Figure 17) and cycled to orbital average mean temperature. Furthermore, the test serves as a low temperature preflight bake-out. Since the test shall show the autonomous operation capability, active commanding of the spacecraft is not foreseen except for contingencies. The system shall be forced in a realistic operational environment, where it has to prove its FDIR capabilities, but no active induction of failures is foreseen in the given time- and budget frame. All presets are comparable to the TBT and TVC setups. The test is applying the Pareto principle in such a way that some of the orbital conditions, such as the BBQ mode, are not simulated during the test to reduce costs. The resulting inaccuracies, such as higher temperature gradients, are seen as the worst case scenario.
The test shall provide the following information: (i)TCS operability and temperature gradients for endless acquisition mode(ii)TCS operability and temperature gradients for autonomous mode(iii)Temperature gradient distribution over solar array for a minimum set of orbit cycles(iv)Positive power generation of solar arrays(v)Flight S/W and payload operability under realistic conditions
The test results show a comparable behavior to the TBT and TVC results (Figure 18), and the payload TRP average temperature shows good consistency with the actual flight data. The test revealed several FDIR behavior-related software issues on the payload side, primarily triggered by the thermal envelopes of different components. The CDH showed its FDIR handling capability towards these issues and proved to be stable through the autonomous operation phase. The recorded issues have been addressed by firmware and software updates prior to launch. Since this was the first full orbit simulation approach of this size for DLR-RY, the operation itself is seen as a feasibility study for the necessity and usefulness of these kinds of tests. For future projects, this type of test can be the first in a row of realistic environmental functionality tests, gradually increasing the focus on FDIR simulation. Again, the availability and flexibility of in-house test facilities proved to be a major asset for the program.
4.6. End-to-End Testing: Panel Deployment
The Eu:CROPIS spacecraft uses a GFRP hinge assembly for solar panel deployment [24]. In contrary to other hinge concepts, the stored energy is originating only from the elastic deformation of the hinge blade geometry. This reduces the number of moving parts and enhances reliability but also allows the panel to follow a three-dimensional trajectory after release actuation, which has a major impact on the test setup. To characterize the deployment motion prior to launch, a dedicated end-to-end test (Figure 19) was performed involving both spacecraft system and ground segment.
The aim of the test was to verify the solar array integration procedures, flight command and actuation chain, and flight procedures: (i)FM electrical power system chain(ii)FM telecommand procedures and chain to C&DH(iii)FM panel release actuator functionality(iv)FM panel deployment mechanism kinematics(v)FM panel release actuator thermistor calibration
The panel deployment procedure is commanded to the FM OBC via TMTC link, while the ground operation team gets a full set of on-board telemetry data from the spacecraft, so live action training including contingencies is performed. The FM OBC will then activate the power interface to the actuators via FM PCDU and the battery. After activation of the release actuators, the panel moves to its deployed position by the stored energy of the tape spring hinges and the panel support arm. The gravity compensation will be achieved via a calibrated helium high altitude balloon attached to the solar panel.
4.7. Cleanliness Control
The Eu:CROPIS satellite is cleanliness controlled. All contamination sources that might impact the appropriate function and performance of the spacecraft in the direction both from the spacecraft into the direction of other systems and payloads and from the external environment onto the spacecraft are analysed. For launch, the Eu:CROPIS satellite is installed on a payload adapter that carries several other secondary payloads and CubeSat dispensers so that, in addition to the flight hardware-specific cleanliness requirements, the overall particular and molecular contamination (PAC and MOC) restrictions for the launch vehicle have to be taken into account to avoid cross-contamination of other payloads. For a long time for the early Eu:CROPIS project phases, no cleanliness standards were defined as applicable on the part of the launch provider Spaceflight Industries. The challenge within the project course was that requirements might become strict due to the fact that cross-contamination of other spacecraft on the integrated stack must be excluded.
Cleanliness verification needs were available only late in the project. Nevertheless, it was beneficial that DLR in-house cleanliness processes were already existent. Those were used for Eu:CROPIS cleanliness measures and it proved that they were successful enough to show compliance to late launch provider cleanliness requirements. The controls were designed and executed from the project team and approved from the launch provider later than the actual implementation of the cleanliness measure processes.
The relevant environmental factors like dust, particle abrasion, and offgassing/outgassing emanations are taken into consideration. The contamination-susceptible units of the spacecraft are cameras, sun sensors, thermal surfaces, solar array cells, parts and interfaces of the solar panel deployment mechanism, and launch adapter interface.
The Eu:CROPIS assembly, integration, and testing takes place in the RY cleanroom facility, ISO 8 class. Measures that are taken to guarantee the required level of cleanliness include the following: (i)Cleanroom cleanliness requirements, including verification(ii)Storage and transportation requirements(iii)(Surface-) cleaning requirements(iv)Cleanliness verification program (a)Inspections(b)Dust particle measurements
The cleanliness inspection standard for the project is defined in NASA standard SN-C-0005 Rev. D: Space Shuttle Contamination Control Requirements. The spacecraft shall be delivered with surfaces VCUE and VCUVS, standard level. Visible cleanliness is defined as the absence of surface-bound contaminant matter (PAC or MOC) detectable with the unaided eye (i.e., no magnification) under defined test conditions: (i)Minimum inspection distance(ii)Ambient light source characteristics(iii)Inspection light source (white light, UV light)
Next to the inspection and photographic documentation, tape lift samples are taken to create witness samples. Surface-bound contaminations of PAC and MOC are transferred to a low-adhesive tape and stored on a defined surface for statistic evaluation under a microscope.
5. Conclusion
This paper presents the AIV program of DLR’s first compact satellite mission Eu:CROPIS launched at the end of 2018. It gives an overview of the scientific mission requirements and identified the technical challenges which arise with a biological payload.
The AIV campaign is explained from various engineering points of view. This includes general management aspects, product assurance, structural properties, thermal environment, and end-to-end verification.
The challenges during the AIV program are twofold: on the one side, technical, and on the other side, management issues. From the technical point of view, launch loads, late access capability, and the magnetic properties were most demanding, while from the management point of view, BSL-1 certification and launch delays were the most challenging. Due to BSL-1 restriction, it was important to perform in-house testing which resulted in a simpler logistic from system integration point of view. At the same time, this allows for a much more flexible scheduling of tests and verification.
Based on the experiences of the Eu:CROPIS AIV campaign, the project lessons learned will help to improve further AIV campaigns at DLR. Some of these improvements are, e.g., a standardized workflow approach (AIV plateau).
Finally, it can be stated that the nominal on-orbit operation of the Eu:CROPIS satellite proves the effectiveness of the previous mentioned AIV approach and methods.
Abbreviations
| AFSPCMAN: | Air Force Space Command Manual |
| AIV: | Assembly, integration, and verification |
| AOCS: | Attitude and Orbit Control System |
| AR: | Acceptance review |
| ATC: | Acceptance test campaign |
| BSL-1: | Biosafety level 1 |
| CAD: | Computer aided design |
| CCS: | Central checkout system |
| CDH: | Command and data handling system |
| CDR: | Critical design review |
| CFRP: | Carbon fiber-reinforced polymer |
| CLA: | Coupled load analysis |
| CPU: | Central processing unit |
| DLR: | Deutsches Zentrum für Luft- und Raumfahrt (German Aerospace Center) |
| ECSS: | European Cooperation for Space Standardization |
| EGSE: | Electrical Ground Support Equipment |
| EOL: | End of life |
| EPS: | Electrical power system |
| ESD: | Electrostatic discharge |
| Eu:CROPIS: | Euglena Combined Regenerative Organic Food Production In Space |
| FEM: | Finite element method |
| GEVS: | General environmental verification specification |
| GMOs: | Genetically modified organisms |
| GNC: | Guidance, navigation, and control |
| GRM: | Ground Reference Model |
| GSE: | Ground Support Equipment |
| IFM: | Interface modules |
| KIP: | Key inspection point |
| LC: | Launch campaign |
| LEOP: | Launch and Early Operations Phase |
| LoS: | Loss of signal |
| MCS: | Mission control system |
| MDPS: | Micrometeoroid and Debris Protection Shield |
| MDS: | Mission data system |
| MGSE: | Mechanical Ground Support Equipment |
| MoI: | Moments of inertia |
| MOS: | Mission operation system |
| MPM: | Mass property measurement |
| MTECU: | Magnetic torquer electronic control unit |
| NCR: | Nonconformance report |
| NRB: | Nonconformance review board |
| OBC: | On-board computer |
| OM: | Office Model |
| ORR: | Operational readiness review |
| OST: | Orbit Simulation Test |
| PA: | Product assurance |
| PCDU: | Power control and distribution unit |
| PCLSS: | Physiochemical life support systems |
| PCM: | Power conversion module |
| PDR: | Preliminary design review |
| PEEK: | Polyether ether ketone |
| QA: | Quality assurance |
| QR: | Qualification review |
| RAMIS: | RAdiation Measurements In Space |
| RoD: | Review of design |
| SCORE: | SCalable On-boaRd computer |
| SDM: | Software Development Model |
| SE: | System engineering |
| SM: | Structural model |
| SMD: | Spacecraft Mass Dummy |
| SMS: | Structure and mechanism subsystem |
| SoE: | Sequence of events |
| SSO-A: | Sun synchronous orbit—mission A |
| STM: | Structural thermal model |
| SVT: | Software verification test |
| TBT: | Thermal Balance Test |
| TMM: | Thermal-Mathematical Model |
| TMTC: | Telemetry and telecommand |
| TPS: | Toyota Production System |
| TVC: | Thermal vacuum chamber. |
Data Availability
The data used to support the findings of this study are included within the article.
Conflicts of Interest
The authors declare that there is no conflict of interest regarding the publication of this paper.
Acknowledgments
We would like to thank the entire Eu:CROPIS team at DLR, our colleagues from Friedrich-Alexander-Universität Erlangen-Nürnberg and NASA’s Ames Research Center. The last years were an amazing time and only with such a motivated team was it possible to deliver a successful mission.